filebeat not sending data to log analytics

Products

• DX OI SaaS

Issue/Introduction

Filebeats not sending data. Logs from Apache server are not showing up in the OI UI -> logs for triage

Filebeats is installed on Windows and log collector is installed on Linux. Log analytics data is being sent to DX OI SAAS.

Resolution

There was an issue with the config file (filebeat.yml). The variables for IP and Tenant were not being passed.
Could see this in the debug log on the log collector.
Notice how tenant and IP were not being substituted:    

"logtype" => "apache_access",
     "@timestamp" => 2024-07-31T13:32:35.871Z,
    "temp_fields" => "%{tenant_id} apache_access <hostname/URL> %{ip} Apache Access Logs F:/tomcat/logs/localhost_access_log..2024-07-31.txt",
            "ecs" => {
        "version" => "8.0.0"