Sidecar unable to find bundled filebeat binary

[williamtrelawny]

Sidecar v1.5 installed on Linux provides a filebeat binary at /usr/lib/graylog-sidecar/filebeat. According to sidecar.yml this is in the default collector_binaries_accesslist.

However, when starting Sidecar with no extra configuration (other than server_url and server_api_token), Sidecar fails to find this binary, saying Couldn't start validation command: fork/exec /usr/share/filebeat/bin/filebeat: no such file or directory".

This has been reported in the Graylog Community as well: https://community.graylog.org/t/sidecar-1-5-cant-start-the-filebeat-that-it-is-shipped-with/30712

Expected Behavior

Sidecar should be able to start, find and execute the filebeat binary to start immediate log collection without further user configuration, per our documentation

Current Behavior

Sidecar fails to find filebeat binary bundled with Sidecar.

Possible Solution

It seems there might be a hard-coded default path Sidecar is looking at (/usr/share/filebeat/bin/filebeat) instead of looking at all locations provided in the default collector_binaries_accesslist. Perhaps this should change.

A workaround for users in the meantime is to create the /usr/share/filebeat/bin directory and create a symbolic link to the existing filebeat binary:

mkdir -p /usr/share/filebeat/bin
ln -s /usr/lib/graylog-sidecar/filebeat /usr/share/filebeat/bin/filebeat

Steps to Reproduce (for bugs)

1. Install & Start Sidecar
2. Observe error in sidecar.log and Graylog web UI

Context

Trying to use Sidecar to manage Filebeat collector on Linux.

Your Environment

• Graylog Version: 6.1.3
• Sidecar Version: 1.5
• Operating System: Debian 12.1