Graylog2 / Graylog2/graylog2-server
Sidecar unable to find bundled filebeat binary
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Sidecar v1.5 installed on Linux provides a filebeat binary at `/usr/lib/graylog-sidecar/filebeat`. According to `sidecar.yml` this is in the default `collector_binaries_accesslist`.
However, when starting Sidecar with no extra configuration (other than `server_url` and `server_api_token`), Sidecar fails to find this binary, saying `Couldn't start validation command: fork/exec /usr/share/filebeat/bin/filebeat: no such file or directory"`.
This has been reported in the Graylog Community as well: https://community.graylog.org/t/sidecar-1-5-cant-start-the-filebeat-that-it-is-shipped-with/30712
## Expected Behavior
Sidecar should be able to start, find and execute the filebeat binary to start immediate log collection without further user configuration, per our [documentation](https://go2docs.graylog.org/current/getting_in_log_data/set_up_sidecar_collectors.htm#ReviewandEditDefaultCollectors)
## Current Behavior
Sidecar fails to find filebeat binary bundled with Sidecar.
## Possible Solution
It seems there might be a hard-coded default path Sidecar is looking at (`/usr/share/filebeat/bin/filebeat`) instead of looking at all locations provided in the default `collector_binaries_accesslist`. Perhaps this should change.
A **_workaround_** for users in the meantime is to create the /usr/share/filebeat/bin directory and create a symbolic link to the existing filebeat binary:
```
mkdir -p /usr/share/filebeat/bin
ln -s /usr/lib/graylog-sidecar/filebeat /usr/share/filebeat/bin/filebeat
```
## Steps to Reproduce (for bugs)
1. Install & Start Sidecar
2. Observe error in sidecar.log and Graylog web UI
## Context
Trying to use Sidecar to manage Filebeat collector on Linux.
## Your Environment
* Graylog Version: 6.1.3
* Sidecar Version: 1.5
* Operating System: Debian 12.1
Contributor guide
Assessment
This issue has not been assessed yet.