linux - Elastic filebeat 6.5.1 error: failed to read process cgroups

Question

I want to install filebeat on my webfaction server in order to ship the apache logs to a hosted ELK.

I followed the instructions.

The filebeat connects wonderfully to the ELK cloud. However locally I cannot get past this error:

[someone@web555 filebeat-6.5.1-linux-x86_64]$ ./filebeat setup
Exiting: error initializing publisher: error initializing processors: 1 error: failed to read process cgroups: open /proc/1/cgroup: no such file or directory

Indeed there is no /proc/1/cgroup just a /proc/cgroups file (note this is a shared server).

I have tried to find a way to disable cgroups but to no avail.

[someone@web555 filebeat-6.5.1-linux-x86_64]$ ./filebeat test output
elasticsearch: https://someoneat.europe-west3.gcp.cloud.es.io:443...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: xx.xxx.xxx.xxx
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
  version: 6.5.1


[someone@web555 filebeat-6.5.1-linux-x86_64]$ ./filebeat test config
Exiting: error initializing publisher: error initializing processors: 1 error: failed to read process cgroups: open /proc/1/cgroup: no such file or directory

Any hints would be appreciated (the free trial will expire in 14 days :D )

Post Scriptum

Only the apache2 module is enabled, I thought disabling system will skip this cgroups check.

[someone@web555 filebeat-6.5.1-linux-x86_64]$ ./filebeat modules list
Enabled:
apache2

Disabled:
auditd
elasticsearch
haproxy
icinga
iis
kafka
kibana
logstash
mongodb
mysql
nginx
osquery
postgresql
redis
suricata
system
traefik

标签： linuxelasticsearchfilebeatwebfactionelastic-beats

Answer 1

感谢Jamie Soriano的上述评论：

您使用的是 add_host_metadata 处理器吗？尝试禁用它，问题似乎是初始化处理器。

事实上，在filebeat.yml我评论了处理器条目（请注意这是默认启用的）。

#================================ Procesors =====================================

# Configure processors to enhance or manipulate events generated by the beat.

processors:
#  - add_host_metadata: ~
#  - add_cloud_metadata: ~

现在，如果我测试配置一切正常：

[someone@web555 filebeat-6.5.1-linux-x86_64]$ ./filebeat test config
Config OK

我不乐意跳过主机元数据，但我至少可以继续发送 apache2 日志！