Graylog2 / Graylog2/graylog2-server

Sidecar unable to find bundled filebeat binary

Open
#21,498 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Sidecar v1.5 installed on Linux provides a filebeat binary at `/usr/lib/graylog-sidecar/filebeat`. According to `sidecar.yml` this is in the default `collector_binaries_accesslist`.

However, when starting Sidecar with no extra configuration (other than `server_url` and `server_api_token`), Sidecar fails to find this binary, saying `Couldn't start validation command: fork/exec /usr/share/filebeat/bin/filebeat: no such file or directory"`.

This has been reported in the Graylog Community as well: https://community.graylog.org/t/sidecar-1-5-cant-start-the-filebeat-that-it-is-shipped-with/30712

## Expected Behavior
Sidecar should be able to start, find and execute the filebeat binary to start immediate log collection without further user configuration, per our [documentation](https://go2docs.graylog.org/current/getting_in_log_data/set_up_sidecar_collectors.htm#ReviewandEditDefaultCollectors)

## Current Behavior
Sidecar fails to find filebeat binary bundled with Sidecar.

## Possible Solution
It seems there might be a hard-coded default path Sidecar is looking at (`/usr/share/filebeat/bin/filebeat`) instead of looking at all locations provided in the default `collector_binaries_accesslist`. Perhaps this should change.

A **_workaround_** for users in the meantime is to create the /usr/share/filebeat/bin directory and create a symbolic link to the existing filebeat binary:
```
mkdir -p /usr/share/filebeat/bin
ln -s /usr/lib/graylog-sidecar/filebeat /usr/share/filebeat/bin/filebeat
```

## Steps to Reproduce (for bugs)
1. Install & Start Sidecar
2. Observe error in sidecar.log and Graylog web UI

## Context
Trying to use Sidecar to manage Filebeat collector on Linux.

## Your Environment

* Graylog Version: 6.1.3
* Sidecar Version: 1.5
* Operating System: Debian 12.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.