无法启动 filebeat.error 缺少字段

Question

下面是我的 filebeat.yml 文件，我无法启动服务出现错误

filebeat.prospectors:
- input_type: log
** paths:**
** - /opt/apache-tomcat-7.0.82/logs/*.log**

document_type: apache-access
fields_under_root: true

output.logstash:
** hosts: '${host}'**

host 是我导出的环境变量 host="10.2.3.1:5044"

Apr 10 06:59:35 node1 filebeat[401]: Exiting: error initializing publisher: missing field accessing 'output.logstash.hosts' (source:'/etc/filebeat/filebeat.yml')
Apr 10 06:59:35 node1 systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE
Apr 10 06:59:35 node1 systemd[1]: Unit filebeat.service entered failed state.
Apr 10 06:59:35 node1 systemd[1]: filebeat.service failed.
Apr 10 06:59:35 node1 systemd[1]: filebeat.service holdoff time over, scheduling restart.
Apr 10 06:59:35 node1 systemd[1]: start request repeated too quickly for filebeat.service
Apr 10 06:59:35 node1 systemd[1]: Failed to start filebeat.
Apr 10 06:59:35 node1 systemd[1]: Unit filebeat.service entered failed state.
Apr 10 06:59:35 node1 systemd[1]: filebeat.service failed.``

Answer 1

通过查看此文件，我发现您的配置存在多个语法差异。页面底部有一些示例，甚至是主机。

https://www.elastic.co/guide/en/beats/filebeat/1.2/using-environ-vars.html

希望对您有所帮助。

Answer 2

我找到了解决方案，问题是 Systemd 不传递环境变量。我开始使用 filebeat 是因为 ./filebeat -e -c filebeat.yml 它对我有用

无法启动 filebeat.error 缺少字段

Unable to start filebeat.error missing fileld

logstash

elastic-stack

filebeat