Product:

Planning Analytics Workspace 2.1.19

Microsoft Windows 2022 server

Issue:

PAA agent is not connecting to PAW.

The file serversinfo.json in folder D:\Program Files\IBM\tm1_64\paa_agent\paaAgentCache should contain the names of your Tm1 instances. If it is empty, the python script have maybe not been able to read the windows services information.

 

Error in messages file in folder D:\Program Files\IBM\tm1_64\paa_agent\wlp\usr\servers\kate-agent\logs

[5/5/26, 15:56:20:933 CEST] 00000046 com.ibm.pa.kate.agent.scheduler.ScheduledTask                E Error occurred while updating the server info json file
java.lang.NullPointerException: Cannot invoke “java.lang.String.length()” because “s” is null
at org.python.core.PyString.charsFitWidth(PyString.java:122)
at org.python.core.Py.fileSystemEncode(Py.java:786)
at org.python.core.PySystemState.initArgv(PySystemState.java:1324)

[5/5/26, 15:57:40:994 CEST] 00000046 ice.notification.PaKateServerUnresponsiveNotificationService E Error occurred while getting latest servers info from json file
java.lang.NullPointerException: Cannot read field “modules” because the return value of “org.python.core.Py.getSystemState()” is null
at org.python.core.PyModule.module___init__(PyModule.java:64)
at org.python.core.PyModule.<init>(PyModule.java:47)
at org.python.util.PythonInterpreter.<init>(PythonInterpreter.java:104)

Solution:

Restore to the bootstrap.properties file that was installed with the upgrade.

Do not use a backed up file of bootstrap.properties – only add the SMTP parameters you need manually to the new bootstrap.properties.

SMTP_EMAIL_START_TLS_ENABLE=FALSE

SMTP_EMAIL_PASSWORD=

SMTP_EMAIL_PORT=25

SMTP_EMAIL_AUTH=FALSE

SMTP_EMAIL_USERNAME=

PAA_EMAIL_ADDRESS=yourname@domain.com

SMTP_EMAIL_HOST=smtp.yourcompany.domain.com

SEND_GRID_API_KEY=””

 

Start the PAA agent from the bat file: D:\Program Files\IBM\tm1_64\paa_agent\bin\PAAAgentStart.bat

 

If above does not work also check this:

  • Re-register/Re-register the Agent Service: If upgrading to PAW 2.0.41 or higher, the agent must be updated.
      1. Stop the service.
      2. Run <install_dir>\paa\bin\PAAAgentDelete.bat.
      3. Run <install_dir>\paa_agent\bin\PAAAgentSetJavaHome.bat.
      4. Run <install_dir>\paa_agent\bin\PAAAgentRegister.bat.

  • Fix Java Path Issue: If the agent fails to start, run PAAAgentSetJavaHome.bat in <install_dir>\paa_agent\bin to ensure the correct Java home is set.

 

Generic:
  • Ensure the PAA Agent is updated to match the version of PA Workspace in use. If not, then download the newer PAA Agent .zip file from PA Workspace administration UI.
  • Review \paa_agent\wlp\usr\servers\kate-agent\bootstrap.properties for PAA Agent configuration errors
  • In \paa_agent\wlp\usr\servers\kate-agent\bootstrap.properties verify SERVERS_DIR points to the parent folder of the TM1 data directories, not directly to one specific data directory.
  • Review \paa_agent\wlp\usr\servers\kate-agent\server.xml for WLP-related errors
  • Review \paa_agent\wlp\usr\servers\kate-agent\logs\ for errors
  • Review \pa_workspace_install\logs\monitor\ for errors
     *The monitor service is what the PA Workspace Administration page uses to communicate with the PAA Agent
  • Review \pa_workspace_install\config\paw.env (or paw.ps1) file
Connectivity-Related Errors:
  • Ensure that the IBM Planning Analytics Administration Agent service is running
  • Ensure that the IBM Planning Analytics Administration Agent service account is configured with english locale
  • Verify that the PAA Agent URL is accessible in a web browser where PAA Agent is installed (ignore the SSL certificate warning)
    URL: https://localhost:9012
    If available, PAA Agent just responds “NOT FOUND The application or context root for this request has not been found”
    *PAA Agent runs on Port 9012 and uses SSL by default
  • Verify that PAA Agent is accessible from inside the docker virtual network of PA Workspace. Open Powershell and run these commands:
    docker exec -it monitor Powershell
    cd curl*
    cd bin
    .\curl -v telnet://paa_agent_servername ipaddress:9012

    Replace “paa_agent_servername” by the exact server name specified in \config\paw.ps1 for “TM1Location” parameter (since PA Workspace finds PAA Agent server from TM1 Admin Server location)

  • In the web browser, verify that the SSL Certificate is valid
    See: https://www.ibm.com/support/pages/node/6562425
  • Verify that the PAA Agent URL is also accessible through the Planning Analytics Workspace host by using browser or curl command
    URL: https://paa_agent_servername:9012
  • Verify that PAA Agent is listening on port 9012: from Windows start menu, run “resmon.exe”, select “Listening Ports”, and verify “javaw.exe” is listening on port 9012
  • In Planning Analytics Administration Tool page, verify the IP addresses returned for the Admin Host and TM1 Server
    URL: http://workspace_servername:8888
  • Does your PAA Agent bootstrap.properties file contain a AGENT_API_KEY setting?
  • Does your PAA Agent use custom SSL?
  • Does your TM1 Admin Server and TM1 Server use custom SSL?
    • Were the certificates imported into the PAA Agent keystore?
Other problems encountered with the PAA Agent might require extra debugging to be enabled for review.

 

Enable PAA Agent Debug Logging:
  • Stop the IBM Planning Analytics Administration Agent service
  • Update the \paa_agent\wlp\usr\servers\kate-agent\bootstrap.properties file to include
    • com.ibm.ws.logging.trace.specification=”*\=audit\:com.ibm.pa.kate.agent.*\=all”
    • com.ibm.ws.logging.console.log.level=ERROR
  • Start the IBM Planning Analytics Administration Agent service
  • Replicate the problem as required
  • Review the files in \paa_agent\wlp\usr\servers\kate-agent\logs\

 

More information:

https://www.ibm.com/support/pages/planning-analytics-administration-agent-not-reachable

https://www.ibm.com/support/pages/how-troubleshoot-planning-analytics-administration-agent

https://www.ibm.com/support/pages/how-obtain-planning-analytics-tm1-server-certificate 

https://www.ibm.com/docs/en/planning-analytics/2.1.0?topic=only-configure-agent-windows 

https://www.ibm.com/docs/en/planning-analytics/2.1.0?topic=cloud-configuring-premises-agent

If you find this error in the message.log for PAA agent instead;

[5/5/26, 17:04:14:303 CEST] 000003d9 bm.pa.kate.agent.service.fileManager.LocalFileManagerService E Failed to CREATE the ‘model_upload’ folder, err:
java.nio.file.NoSuchFileException: d:\tm1 data\faptest\Data\;.\Data_SysSettings\model_upload
at java.base/sun.nio.fs.WindowsException.translateToIOException(Unknown Source)
at java.base/sun.nio.fs.WindowsException.rethrowAsIOException(Unknown Source)
at java.base/sun.nio.fs.WindowsException.rethrowAsIOException(Unknown Source)
at java.base/sun.nio.fs.WindowsFileSystemProvider.createDirectory(Unknown Source)

Then you have more than one DATA folder, and the model_upload folder is created in wrong data folder. PAW PA Agent does not support more than one DATA folder listed in TM1S.CFG file.

Product:

Cognos Analytics version 12.1.2.15
Cognos Controller version  11.1.1003
Microsoft Windows 2022 server

Issue:

After upgrade to later version of Cognos Analytics, that is used for CAM login and Controller standard reports, the reports inside Cognos Controller does not work.

Solution:

The newer version of CA 12.0.4 and later have a different setup of MIME parameters. This is setup in IIS by the new CA_IIS_Config.bat script.

You can add it manually to IIS.

Go to IIS Manager and select the web site “ibmcognos”

Click on the MIME types icon

Add this

.mjs : application/javascript

Click OK

And restart the IIS server.

Restart Cognos Controller and run a standard report again.

 

More Information:

https://www.ibm.com/support/pages/all-cognos-pdf-reports-render-blank

https://www.ibm.com/support/pages/opening-pdf-output-cognos-analytics-shows-blank-page 

https://www.ibm.com/docs/en/controller/11.1.2?topic=options-import-controller-standard-reports-package

https://www.ibm.com/support/pages/how-configure-ibm-cognos-controller-use-cognos-controller-embedded-report-library-ibm-cognos-controller-reports-standard-report-engine-ccrreports

Product:
Planning Analytics 2.1.14
Microsoft Windows 2022 server

Issue:
How many RUNPROCESS can you run in parallel on a server?

RunProcess lets you run TurboIntegrator processes in parallel, each on its own thread that is managed by TM1® Server. This approach speeds up data load and other operations where TurboIntegrator processes are used to divide the work.

Suggested Solution:

You can only run, same number of virtual CPU cores you have on the server, with the RUNPROCESS command, to ensure proper data handling.

If you run more RUNPROCESS command than CPU cores, you may get that CELLPUTN command will not be executed, and you will not get a error. The process continue as all is fine.  On the other hand ASCIIOUTPUT maybe will work fine, so to run more RUNPROCESS in parallel to only create csv files works better.

If you have the ASCIIOUTPUT in the Data tab, and then the CELLPUTN in the Epilog tab of your TI process that you call from a RUNPROCESS command,

add a SLEEP (1001) before the CELLPUTN line, will in some cases solve the issue.

The solution is to add a delay somewhere in the processes, to make the server catch up with what you try to do.

 

More Information:

https://code.cubewise.com/blog/4-ways-to-speed-up-your-processes-in-ibm-tm1-and-planning-analytics/

https://www.ibm.com/docs/en/planning-analytics/2.1.0?topic=tf-process-control-turbointegrator-functions

https://aggregated.blogspot.com/2015/02/running-tm1-processes-from-outside-tm1.html

https://www.ibm.com/docs/fi/planning-analytics/2.0.0?topic=mtf-logoutput-1

 

Product:
Planning Analytic 2.1.19  tm1server = 11.8.03500.6

Microsoft Windows 2019 server

Issue:

How use SUBST instead of STR function in a process?

In PAL 2.1.18 STR function does not truncate a string when a length parameter is passed. The original value is returned as a string.

Solution:

This should give the same result

sTestA = STR(1000000, 4, 0) ;
sTestB = SUBST (numbertostring (1000000) , 1, 4) ;

 

Syntax for SUBST is:

SubSt(String, Beginning, Length)​

  • ​String = A text string​
  • Beginning = Substring starting position​
  • Length = Length of the string that we want to keep

 

More Information:

 

Product:

Cognos Analytics 12.1.1
Microsoft Windows 2019 server

Issue:

During over-the-top upgrade of CA, you get a error that folders in use c:\program files\ibm\cognos\analytics\cgi-bin

Solution:

Stop the IBM Cognos service, and also stop the World Wide Web Publishing Service.

Try then to run the installation again.

 

More information:

Before upgrade, backup the content store database, and export the content to a zip archive from Cognos.
Export the Cognos Configuration to a xml file.

During installation, the [Cognos Install]\deployment and the [Cognos Install]\data\search folders will be moved twice, which can cause the installer to appear as though it has stopped working. As these folders are often very large, it is advisable to move them to a location outside the Cognos Analytics installation folder prior to applying the update, then move them back after the update has completed, prior to restarting Cognos Analytics.

 

Upgrade steps on Windows:

1. Stop the Cognos Analytics Service and close down Cognos Configuration. If you have installed an optional Gateway, please stop the Apache or IIS webserver services.

2. Launch the downloaded installation file and follow the wizard.

3. Choose your Language and click Next.

4. Choose What you want to install – for an upgrade this will be IBM Cognos Analytics click Next.

5. Choose to Accept the license and click Next.

6. Choose the location. This must be the location of your Cognos Analytics instance that you would like to upgrade and also the shortcut folder name. Click Next.

7. Click Yes to confirm you are Installing in the same location and are overwriting a previous installation.

8. Click Install at the summary screen.

9. When complete click Done to complete the upgrade.

10. Open Cognos Configuration – you will be prompted that older versions of Configuration files were found and configuration files have been upgrade to the latest version. click OK and Save your configuration.

11. Repeat the steps for all instances in your distributed environment before starting the Cognos Analytics Services and start the webserver

Cognos 11.2.4 End of Support: Why You Must Upgrade to Cognos 12 Before April 2026

https://www.ibm.com/docs/en/cognos-analytics/12.0.x?topic=analytics-upgrading-cognos

Product:

Planning Analytics 2.1.14
Microsoft Windows 2022 server

Issue:

How replace \ with / in a string in a TM1 TI process?

Solution:

Enter below code in you prolog:

vTemp = '';
vChar = '';
k=1;
WHILE( k <= LONG(pFilePath) );
  vChar = SUBST(pFilePath, k, 1);
  IF(vChar @= '\');
    vChar = '/';
  ENDIF;
  vTemp = vTemp | vChar;
  k = k + 1;

END;
NewFilePath = vTemp;

Content in pFilePath will be updated to NewFilePath variable.

More information:

WHILE Function: How to Use, Syntax, and Examples

https://cubewise.com/functions-library/tm1-function-for-ti-while/ 

Product:
Planning Analytics 2.1.14
Microsoft Windows 2022 Server

Issue:

How call RUSHTI.EXE from TI process when using SSO with IntegratedSecurityMode=5  (CAM)?

https://github.com/cubewise-code/rushti

Solution:

Run the TM1 service  (IBM TM1 Admin Server x64) and TM1 application service (IBM TM1 Server x64 – budget) with a windows account in your domain, that have rights inside your TM1 application (maybe ADMIN).  The ExecuteCommand is run with the user who runs the TM1 service.
Go to Windows service, and for your TM1 service, change the log on from Local System to account (a service account that does not change password) in the domain.

To call RUSHTI from a TI process enter something like this:

sCMD = 'd:\rushti\rushti run --tm1-instance "Budget" --workflow "load data fast" --max-workers 8 --mode opt' ;
ExecuteCommand(sCMD, 1);

 

https://github.com/cubewise-code/rushti/releases

To install RUSHTI.EXE you need to download the zip file, and unpack it to a folder on your server (d:\rushti)

Installation

  1. Download rushti-windows.zip  (to start with, take this file https://github.com/cubewise-code/rushti/releases/download/v2.0.0/rushti-windows.zip )
  2. Extract to your desired location (keeps directory structure intact)
  3. Copy config/config.ini.template to config.ini and configure your TM1 connections
  4. (Optional) Copy config/settings.ini.template to settings.ini for custom defaults
  5. Run rushti.exe from command line

Note: This build uses PyInstaller’s onedir mode for fast cold starts.
Keep all files in the extracted directory together – the exe requires the bundled libraries.

You must have the files in the _internal folder, the files can not be replaced.

The config.ini contains the information to connect to your TM1 instance. Change for your environment, ports etc:

# The section name (e.g., [Budget]) is used as the instance identifier
# in task files and command-line arguments.
# For SSO set username to blank etc
# Copy this file to config.ini and update with your actual TM1 server details.
# the name of the tm1 application you should work with
[Budget]
# TM1 server hostname or IP address
address=tm1servername.domain.com
# REST API port (check your tm1s.cfg HTTPPortNumber setting)
port=12387
namespace=AD
gateway=http://caservername.domain.com:80/ibmcognos/bi/v1/disp
user=""
password=""
# Set to True if password is base64 encoded
decode_b64=False
# Set to True if TM1 server uses HTTPS (check UseSSL in tm1s.cfg)
ssl=True

 

Settings.ini is the file for defaults of the system to activate collection of data to database etc. It can look like this:

# RushTI Settings Configuration
# ==============================
#
# This file configures RushTI behavior settings, separate from TM1 connection
# settings in config.ini.
#
# Settings Precedence (highest to lowest):
# 1. CLI arguments (e.g., --max-workers 8)
# 2. JSON task file settings section
# 3. This settings.ini file
# 4. Built-in defaults
#
# To use this file:
# 1. Copy to settings.ini in the directory called config
# 2. Uncomment and modify the settings you need
# 3. Delete or leave commented any settings you want to use defaults for
# ------------------------------------------------------------------------------
# [defaults] - Common execution settings
# ------------------------------------------------------------------------------
[defaults]
# Maximum number of parallel workers
# Valid range: 1-100 (start with the same amount of CPU cores you have on the server)
# Default: 4
max_workers = 8

# Number of retries for failed process executions
# Valid range: 0-10
# Default: 0
# retries = 0

# Output file path for execution results summary CSV
# Set to a file path to create a summary CSV (e.g. rushti.csv)
# Leave empty or omit to skip creating the summary CSV
# Default: (empty - no CSV created)
result_file = rushti.csv

# Execution mode: 'norm' (normal) or 'opt' (optimized with dependencies)
# Default: norm
mode = opt

# ------------------------------------------------------------------------------
# [optimization] - Automatic task ordering optimization
# ------------------------------------------------------------------------------
[optimization]

# Enable automatic task optimization during execution.
# When enabled, ready tasks are sorted by estimated runtime (longest first)
# to maximize parallel efficiency. Dependencies are always preserved.
#
# Requires: [stats] enabled = true (needs historical data for estimates)
# Override: Use --no-optimize flag to disable for a specific run
#
# Default: false
# enabled = false

# ------------------------------------------------------------------------------
# [logging] - Enhanced logging settings / you must adjust this file to make it work
# ------------------------------------------------------------------------------
[logging]
# level = INFO
# file = /log/rushti.log

# ------------------------------------------------------------------------------
# [tm1_integration] - TM1 integration for reading taskfiles and logging results
# ------------------------------------------------------------------------------
[tm1_integration]

# Push execution results to TM1
# When enabled, the results CSV is uploaded to TM1 files after each run
# as: rushti_{workflow}_{run_id}.csv
#
# To set up TM1 integration:
# 1. Run: python rushti.py build --tm1-instance tm1srv01
# This creates the required dimensions and cube automatically.
# 2. Set push_results = true and configure default_tm1_instance below
#
# Default: false
push_results = true

# Automatically load results into TM1 cube after push
# When enabled (and push_results = true), calls }rushti.load.results TI process
# on the target TM1 instance after uploading the results CSV.
# The TI process must exist on the target instance.
#
# Default: false
# auto_load_results = false

# Default TM1 instance for reading taskfiles and writing results
# Used when --tm1-instance is specified without an instance, and for auto-upload
# Must be defined in config.ini, set the name for the section in config file.
default_tm1_instance = Budget

# Default cube name for task definitions and results
# The build command creates this cube with dimensions:
# - rushti_workflow: Workflow identifiers
# - rushti_task_id: Task sequence (1-5000 default elements)
# - rushti_run_id: "Input" for definitions, timestamps for results
# - rushti_measure: Task field measures
#
# Default: rushti
default_rushti_cube = rushti

# ------------------------------------------------------------------------------
# [stats] - SQLite stats database for execution history
# ------------------------------------------------------------------------------
[stats]

# Enable the stats database for storing execution history
# The stats database stores execution statistics for:
# - Optimization features (EWMA runtime estimation)
# - TM1 cube logging data source
# - Historical analysis via 'rushti db' commands
# Default: false
enabled = true

# Path to the SQLite database file
# Relative paths are resolved from the application directory
# Default: data/rushti_stats.db
db_path = data/rushti_stats.db

# Number of days to retain execution history
# Valid range: 1-365
# Default: 90
retention_days = 90


To create the RUSHTI cube, you run the command:

rushti build --tm1-instance "Budget"

If not using a CUBE for the tasks, you can use a TXT file. See link.
https://code.cubewise.com/open-source/tm1py/rushti/

To create an HTML file of the run information, enter command like below in the DOS prompt:

rushti tasks visualize  --tm1-instance "Budget"  --workflow "load data fast"  --output dag.html

Open the dag.htlm file in your web browser (with javascript enabled).

In the RUSHTI cube, you can use the predecessors column to tell what process should be finish before this process start. In below example the process number 3 starts first when process 2 is finished.

in process filed, enter the name of the TI process to run.

In parameters field, when you have more parameters than one , they can be formatted like this:

{ "pVersion": "Prognos 1", "pYear": "2025" , "pMonth": "03" }

There is a colon (:) between the prompt and the value, and a comma (,) between the parameters, or the simpler format shown below will work (you need the space before ,):

pVersion=Budget , pYear=2026 , pMonth=01

If you have a path in your parameter, then you need to enter / (forward slash) instead of \. So it should look like this:

{ "pNewCube": "thecubename", "pFilePath": "D:/Tm1 Data/budget/Export/to_other/read/Budget_2026_01.csv" }

You need to create a element in dim Rushti_workflow for your tasks settings, this i called from the rush command. For it to know what task list it should execute on, in the cube. e.g. –workflow “load data fast”

 

 

More Information:

https://www.ibm.com/docs/en/planning-analytics/2.0.0?topic=pctf-executecommand

https://code.cubewise.com/blog/introducing-the-tm1py-universe/

Full documentation is available at cubewise-code.github.io/rushti/docs

https://code.cubewise.com/downloads/

https://code.cubewise.com/blog/run-processes-in-parallel-using-only-connection/

Product:
Microsoft Windows 2022 server

Issue:

List users who have access to a folder from script?

Solution:

Start a powershell window and enter something like this:

$path = "C:\Your\Folder\Path"
(Get-Acl $path).Access |
    Select-Object IdentityReference, FileSystemRights, AccessControlType, IsInherited |
    Format-Table -AutoSize
More information:

 

Product:
Mirantis Docker
Microsoft Windows 2022 server

Issue:

How update the lic file on the docker installation on a Windows server?

Solution:

Buy a new license (Mirantis Container Runtime with LabCare Support) from Mirantis, one per PAW server. You will get a mail with a link, that will download the MCR file direct to your computer.

Then rename the file from like MCR 3xNode LabCare.lic  to docker.lic.

Copy the docker.lic file to your docker folder – normally that is D:\docker on your Planning Analytics Workspace (PAW) server.

 

To check that you have a license, enter below in CMD:

docker info --format '{{.ProductLicense}}'

You should get a text like this ‘Valid until 2026-04-09 for sf0643587264358638568230756MAC’ if all is fine.

 

More Information:

https://docs.mirantis.com/mcr/25.0/single/index.html#install-the-license

You can update the license in your cluster at any time during the week before your license expire.

As per our terms of service – “Users are not authorized to run MCR without a valid license.”, but even if you do not replace the license after the 10th, the docker service will not be forcefully stopped and there won’t be any interruptions to your applications and workloads.

You download Mirantis license (.lic) files from the Mirantis CloudCare Portal (or from a purchase confirmation email, depending on the product):

For MKE / MSR / MKE 4k:

  1. Find the email from Mirantis Support with subject similar to “Welcome to Mirantis’ CloudCare Portal” and log in as instructed. [MKE 3.7 licenseMSR 2.9 license]
  2. In the top navigation bar, click Environments.
  3. Click the Cloud Name associated with the license you need.
  4. Scroll down to License Information and click the License File URL.
  5. In the new tab, click View file to download the .lic file. [MKE 3.8 licenseMSR 2.9 single]

For MCR (Mirantis Container Runtime):

  • If you bought via the Mirantis Store, the license file is available from the link in your purchase confirmation email. Otherwise, you must contact Mirantis Sales/Support to get the file. [MCR 25.0 license]  

For Mirantis Container Runtime (MCR) / Mirantis Docker Engine, the license file must be placed in the daemon data directory and named docker.lic.

On Windows (default path):

Install MKE offline – Mirantis Kubernetes Engine

Index of win/static/stable/x86_64

By default, MCR automatically records and transmits data to Mirantis for monitoring and analysis purposes. The data collected provides the Mirantis Customer Success Organization with information that helps us to better understand the operational use of MCR by our customers. It also provides key feedback in the form of product usage statistics, which enable our product teams to enhance Mirantis products and services.

When antivirus and antimalware software products scan files in use by MCR, these files can lock in a way that causes Docker commands to hang or causes orphaned snapshots to leak disk space. To circumvent these problems, you can add the Docker data directory to the software’s exclusion list, which is by default /var/lib/docker on Linux systems and %ProgramData%\docker on Windows Server systems. As a result of this action, though, viruses or malware in local Docker images, writable layers of containers, or volumes will go undetected.

Product:
FileBeat 8.19.3

Microsoft Windows 2022 server

Issue:

Have installed filebeat service in windows, to collect logs files to elastic, but it does not read any files. And when i try to stop the services it hangs.

After you stop the filebeat service with Task Manager, you need to erase the lock file in folder C:\ProgramData\filebeat\ to make it to read the yml file at next start of the service.

Solution:

Check the filebeat.yml file. The JSON format is sensitive to spaces and other formats.

In this case there was a row:
ignore_older: ‘7d’
that made the filebeat service to stop.

It only supports minutes and hours, so you need to enter like this:
ignore_older: ‘168h’

The ignore_older: ‘168h’ function will check the timestamp of the file, and not read files that was created more than 7 days ago.

The filebeat.yml file is in folder C:\Program Files\Filebeat on windows.

Below a example of a filebeat.yml file for use with TM1 logs files – you need to add spaces in the beginning of every line to get it to work.

# ============================== Filebeat inputs ===============================
filebeat.inputs:
- type: filestream
id: tm1server
enabled: true

paths:
- D:/TM1 folder/Logs/tm1server.log
fields_under_root: true
fields:
event:
dataset: audit.plain

- type: filestream
id: tm1s2
enabled: true
ignore_older: '168h'
paths:
- D:/TM1 folder/Logs/tm1s2*.log
exclude_lines:
- '^#'
include_lines:
- 'AD'
fields_under_root: true
fields:
event:
dataset: audit.plain

# ---------------------- beats state ----------------------
- type: filestream
id: beats-logs
enabled: true
paths:
- C:/ProgramData/filebeat/logs/filebeat*.ndjson
include_lines:
- 'Non-zero metrics in the last 30s'
fields_under_root: true
fields:
event:
dataset: beats.state
processors:
- dissect:
tokenizer: '%{}"@timestamp":"%{event.start}"'
field: message
target_prefix: ""
ignore_failure: true
setup.template.settings:
index.number_of_shards: 1
fields:
system:
env: prod
id: SystemTM1
fields_under_root: true
max_procs: 1
processors:
- add_host_metadata:
when.not.contains.tags: forwarded
- add_cloud_metadata: ~
output.logstash:
hosts: ["elasticservername.domain.com:9999"]
ssl.enabled: true
ttl: 5m
pipelining: 0



More Information:

Filebeat sends log files to Logstash or directly to Elasticsearch.

## Getting Started

To get started with Filebeat, you need to set up Elasticsearch on
your localhost first. After that, start Filebeat with:

./filebeat -c filebeat.yml -e

This will start Filebeat and send the data to your Elasticsearch
instance. To load the dashboards for Filebeat into Kibana, run:

./filebeat setup -e

For further steps visit the (https://www.elastic.co/guide/en/beats/filebeat/8.19/filebeat-installation-configuration.html) guide.

## Documentation

Visit (https://www.elastic.co/guide/en/beats/filebeat/8.19/index.html) for the full Filebeat documentation.

## Release notes

https://www.elastic.co/guide/en/beats/libbeat/8.19/release-notes-8.19.3.html

https://www.elastic.co/beats/filebeat

https://www.elastic.co/downloads/beats/filebeat

https://github.com/elastic/beats