filebeat: missing modules

[bbenno]

Describe the bug

Enabling the nginx module in the filebeat service results in the service crashing because it cannot find and load the module.

Steps To Reproduce

Steps to reproduce the behavior:

1. Conigure filebeat with appropriate module configuration

{ config, pkgs, lib, ... }:
{
  services.nginx.enable = true;
  # [...]
  services.filebeat = {
    enable = true;
    package = pkgs.filebeat7;
    modules.nginx = let nginxLogPath = "/var/log/nginx/";
    in {
      access = {
        enabled = true;
        var.paths = map (x: nginxLogPath + x) [ "access.log*" ];
      };
      error = {
        enabled = true;
        var.paths = map (x: nginxLogPath + x) [ "error.log*" ];
      };
    };
  };
}

2. nixos-rebuild
3. systemctl status filebeat → Failed to start Filebeat log shipper.

> journalctl -eu filebeat
[...]
INFO        instance/beat.go:328        Setup Beat: filebeat; Version: 7.16.1
INFO        [index-management]        idxmgmt/std.go:184        Set output.elasticsearch.index to 'filebeat-7.16.1' as ILM is enabled.
INFO        [esclientleg]        eslegclient/connection.go:102        elasticsearch url: https://[...].aws.cloud.es.io:443
INFO        [publisher]        pipeline/module.go:113        Beat name: [...]
ERROR        [modules]        fileset/modules.go:142        Not loading modules. Module directory not found: /nix/store/x2nzjy32zlh47pbbblcx6mk7nldm27ig-filebeat-7.16.1/bin/module
INFO        instance/beat.go:461        filebeat stopped.
ERROR        instance/beat.go:1015        Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?
Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?
filebeat.service: Main process exited, code=exited, status=1/FAILURE
[...]

Expected behavior

The filebeat.service starts and runs without issues.

Additional context

filebeat expects modules files within the non-existent /nix/store/...-filebeat-7.16.1/bin/module folder.
The /nix/store/...-filebeat-7.16.1/bin only contains the filebeat executable.

Notify maintainers

@fadenb @basvandijk

Metadata

> nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 5.10.108, NixOS, 21.11 (Porcupine)`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.3.16`
 - channels(root): `"nixos-21.11.336755.efea022d6fe, home-manager-21.11"`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixos`

[PedroHLC]

@happysalada I'm still investigating this one

[PedroHLC]

Took me a while but I finally understood what was happening here:

The original project uses a Makefile to build all the beats, with it you must first run make update in libbeat, then build the beats, then run mage update on each. On the "update" they prepare a python-env and then run other three jobs: mage fields, mage collect, and mage config. With that, a build/package directory is created in each beat's directory, and within filebeat's one is the modules directory as we want it.

I'll try opening a PR fixing this at least implementing the mage calls (their Makefile is very impure), otherwise, I think adding this to filebeat7 can do the job too:

{
    postInstall = ''
      find filebeat/module -name "*.yml" -printf "%P\n" |\
        xargs -I '?' -- install -DT "filebeat/module/?" "$out/bin/module/?"
    '';
}

[happysalada]

Just want to say I didn't close this. If you put fix issue_number in the body of a PR, it will automatically close the related issue when the PR is merged. Just to let you know for next time.
Thank you for investigating this!

[sjdwhiting]

@bbenno, did you ever get this working? I'm running into the same issue.

ERROR [modules] fileset/modules.go:142 Not loading modules. Module directory not found: /nix/store/nngfglk033yqxfmcxscbhcs46j24xhhn-filebeat-7.17.4/bin/module

Configuration.nix

      modules = {
         auditd = {
           log = {
             enabled = true;
             var.path  = [ "/var/log/audit/audit.log*" ];
           };
         };
         nginx = {
           access = {
             enabled = true;
             var.paths = [ "/path/to/log/nginx/access.log*" ];
           };
           error = {
             enabled = true;
             var.paths = [ "/path/to/log/nginx/error.log*" ];
           };
         };
       };