Start your 14-day free trial today
No Credit Card Required
Try Logit.io FreeAlready have an account? Sign In
Logstash Rabbitmq App Configuration
Ship RabbitMQ application logs to logstash
Step 1 - Install Filebeat
deb (Debian/Ubuntu/Mint)
curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-amd64.deb
sudo dpkg -i -oss-7.15.1-amd64.deb
rpm (CentOS/RHEL/Fedora)
curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-x86_64.rpm
sudo rpm -vi -oss-7.15.1-x86_64.rpm
macOS
curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-darwin-x86_64.tar.gz
tar xzvf -oss-7.15.1-darwin-x86_64.tar.gz
Windows
- Download and extract the Windows zip file.
- Rename the
-<version>-windows
directory to ``. - Open a PowerShell prompt as an Administrator.
- Run the following to install as a Windows service:
.\install-service-.ps1
PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-.ps1
.
Step 3 - Add RabbitMQ Log Location
Filebeat does not currently have a module to process the rabbitmq application logs.
Therefore we need to add the rabbitmq application log location to the filebeat inputs. Since rabbitmq uses a multi-line log format we will need to configure a seperate log section to handle it.
Add the following to the end of the log input example, before the filebeat.config.modules
section.
- type: log
enabled: true
paths:
- /var/log/rabbitmq/*.log
fields:
type: rabbitmq
multiline.pattern: ^\=
multiline.match: before
If you’re running Filebeat 8.1+ filebeat.inputs
needs to be filestream
instead of logs
:
filebeat.inputs:
- type: filestream
enabled: true
paths:
- /var/log/rabbitmq/*.log
fields:
type: rabbitmq
multiline.pattern: ^\=
multiline.match: before
Step 4 - Configure output
We'll be shipping to Logstash so that we have the option to run filters before the data is indexed.
Comment out the elasticsearch output block.
## Comment out elasticsearch output
#output.elasticsearch:
# hosts: ["localhost:9200"]
Step 5 - Validate configuration
Let's check the configuration file is syntactically correct by running directly inside the terminal.
If the file is invalid, will print an error loading config file
error message with details on how to correct the problem.
deb/rpm
sudo -e -c /etc//.yml
macOS
cd <EXTRACTED_ARCHIVE>
./ -e -c .yml
Windows
cd <EXTRACTED_ARCHIVE>
.\.exe -e -c .yml
Step 6 - Start Filebeat
Ok, time to start ingesting data!
deb/rpm
sudo systemctl enable filebeat
sudo systemctl start filebeat
Step 7 - how to diagnose no data in Stack
If you don't see data appearing in your Stack after following the steps, visit the Help Centre guide for steps to diagnose no data appearing in your Stack or Chat to support now.