This post is older than a year. Consider some information might not be accurate anymore.
Used: filebeat-1.2.3
Starting with filebeat can be troublesome, if a misconfiguration exists or he is not sending the logs to logstash or elasticsearch. To analyse that start filebeat in debug mode filebeat -e -v -d '*'.
An example with a JBoss log file.
vinh@omega:~/filebeat-1.2.3-x86_64> filebeat -e -v -d '*'
..
2016/06/10 16:06:18.198911 prospector.go:185: DBG Start next scan
2016/06/10 16:06:18.198972 prospector.go:261: DBG scan path /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:18.199023 prospector.go:275: DBG Check file for harvesting: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:18.199045 registrar.go:175: DBG Same file as before found. Fetch the state.
2016/06/10 16:06:18.199059 prospector.go:418: DBG Update existing file for harvesting: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:18.199079 prospector.go:465: DBG Not harvesting, file didn't change: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:25.669644 spooler.go:97: DBG Flushing spooler because of timeout. Events flushed: 0
2016/06/10 16:06:27.241279 reader.go:138: DBG End of file reached: /opt/jboss/jboss-eap-6.4/standalone/log/server.log; Backoff now.
2016/06/10 16:06:28.199345 prospector.go:185: DBG Start next scan
2016/06/10 16:06:28.199420 prospector.go:261: DBG scan path /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:28.199483 prospector.go:275: DBG Check file for harvesting: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:28.199539 registrar.go:175: DBG Same file as before found. Fetch the state.
2016/06/10 16:06:28.199556 prospector.go:418: DBG Update existing file for harvesting: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:28.199571 prospector.go:465: DBG Not harvesting, file didn't change: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:30.669715 spooler.go:97: DBG Flushing spooler because of timeout. Events flushed: 0
2016/06/10 16:06:37.241659 reader.go:138: DBG End of file reached: /opt/jboss/jboss-eap-6.4/standalone/log/server.log; Backoff now.
2016/06/10 16:06:38.169614 spooler.go:97: DBG Flushing spooler because of timeout. Events flushed: 0
2016/06/10 16:06:38.199875 prospector.go:185: DBG Start next scan
2016/06/10 16:06:38.199934 prospector.go:261: DBG scan path /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:38.199981 prospector.go:275: DBG Check file for harvesting: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:38.200003 registrar.go:175: DBG Same file as before found. Fetch the state.
2016/06/10 16:06:38.200016 prospector.go:418: DBG Update existing file for harvesting: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:38.200029 prospector.go:465: DBG Not harvesting, file didn't change: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:45.669682 spooler.go:97: DBG Flushing spooler because of timeout. Events flushed: 0
2016/06/10 16:06:47.242029 reader.go:138: DBG End of file reached: /opt/jboss/jboss-eap-6.4/standalone/log/server.log; Backoff now.
2016/06/10 16:06:48.200232 prospector.go:185: DBG Start next scan
2016/06/10 16:06:48.200285 prospector.go:261: DBG scan path /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:48.200334 prospector.go:275: DBG Check file for harvesting: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:48.200354 registrar.go:175: DBG Same file as before found. Fetch the state.
2016/06/10 16:06:48.200367 prospector.go:418: DBG Update existing file for harvesting: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
2016/06/10 16:06:48.200380 prospector.go:465: DBG Not harvesting, file didn't change: /opt/jboss/jboss-eap-6.4/standalone/log/server.log
^C2016/06/10 16:06:48.244750 service.go:30: DBG Received sigterm/sigint, stopping
2016/06/10 16:06:48.244803 registrar.go:133: INFO Stopping Registrar
2016/06/10 16:06:48.244841 registrar.go:97: INFO Ending Registrar
2016/06/10 16:06:48.244860 registrar.go:146: DBG Write registry file: /home/vinh/filebeat-1.2.3-x86_64/.filebeat
2016/06/10 16:06:48.245252 registrar.go:162: INFO Registry file updated. 1 states written.
2016/06/10 16:06:48.245451 beat.go:183: INFO Cleaning up filebeat before shutting down.
