408 HTTP Error when running filebeat setup

Elastic Stack Beats
1

Hello !

I'm trying to run filebeat setup -e on my local machine and it fails with the following error error loading index pattern: returned 408 to import file: <nil>. I'm using the latest version of filebeat (7.13.1) and using Elastic Cloud. My filebeat.yml is the original one with my cloud id and cloud auth. No modules enabled.

$ ./filebeat.exe setup -e -v
2021-06-14T11:23:14.609+0200    INFO    instance/beat.go:665    Home path: [C:\Users\Dev\elastic\filebeat-7.13.1-windows-x86_64] Config path: [C:\Users\Dev\elastic\filebeat-7.13.1-windows-x86_64] Data path: [C:\Users\Dev\elastic\filebeat-7.13.1-windows-x86_64\data] Logs path: [C:\Users\Dev\elastic\filebeat-7.13.1-windows-x86_64\logs]
2021-06-14T11:23:14.609+0200    INFO    instance/beat.go:673    Beat ID: 6526***0a1a
2021-06-14T11:23:14.655+0200    INFO    [beat]  instance/beat.go:1014   Beat info       {"system_info": {"beat": {"path": {"config": "C:\\Users\\Dev\\elastic\\filebeat-7.13.1-windows-x86_64", "data": "C:\\Users\\Dev\\elastic\\filebeat-7.13.1-windows-x86_64\\data", "home": "C:\\Users\\Dev\\elastic\\filebeat-7.13.1-windows-x86_64", "logs": "C:\\Users\\Dev\\elastic\\filebeat-7.13.1-windows-x86_64\\logs"}, "type": "filebeat", "uuid": "6526***0a1a"}}}
2021-06-14T11:23:14.655+0200    INFO    [beat]  instance/beat.go:1023   Build info      {"system_info": {"build": {"commit": "2d80f6e99f41b65a270d61706fa98d13cfbda18d", "libbeat": "7.13.1", "time": "2021-05-28T17:43:52.000Z", "version": "7.13.1"}}}
2021-06-14T11:23:14.655+0200    INFO    [beat]  instance/beat.go:1026   Go runtime info {"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":4,"version":"go1.15.12"}}}
2021-06-14T11:23:14.683+0200    INFO    [beat]  instance/beat.go:1030   Host info       {"system_info": {"host": {"architecture":"x86_64","boot_time":"2021-06-14T10:50:32.31+02:00","name":"DESKTOP-0SNUGLG","ip":["192.168.1.76/24","os":{"type":"windows","family":"windows","platform":"windows","name":"Windows 10 Education","version":"10.0","major":10,"minor":0,"patch":0,"build":"19041.1052"},"timezone":"CEST","timezone_offset_sec":7200}}}
2021-06-14T11:23:14.683+0200    INFO    [beat]  instance/beat.go:1059   Process info    {"system_info": {"process": {"cwd": "C:\\Users\\Dev\\elastic\\filebeat-7.13.1-windows-x86_64", "exe": "C:\\Users\\Dev\\elastic\\filebeat-7.13.1-windows-x86_64\\filebeat.exe", "name": "filebeat.exe", "pid": 11772, "ppid": 10992, "start_time": "2021-06-14T11:23:14.405+0200"}}}
2021-06-14T11:23:14.683+0200    INFO    instance/beat.go:309    Setup Beat: filebeat; Version: 7.13.1
2021-06-14T11:23:14.683+0200    INFO    [index-management]      idxmgmt/std.go:184      Set output.elasticsearch.index to 'filebeat-7.13.1' as ILM is enabled.
2021-06-14T11:23:14.684+0200    INFO    eslegclient/connection.go:99    elasticsearch url: https://133e8d***2ea49f017d.us-west1.gcp.cloud.es.io:443
2021-06-14T11:23:14.684+0200    INFO    [publisher]     pipeline/module.go:113  Beat name: DESKTOP-0SNUGLG
2021-06-14T11:23:14.691+0200    INFO    eslegclient/connection.go:99    elasticsearch url: https://133e8d***2ea49f017d.us-west1.gcp.cloud.es.io:443
2021-06-14T11:23:15.663+0200    INFO    [esclientleg]   eslegclient/connection.go:314   Attempting to connect to Elasticsearch version 7.13.1
Overwriting ILM policy is disabled. Set setup.ilm.overwrite: true for enabling.

2021-06-14T11:23:15.869+0200    INFO    [index-management]      idxmgmt/std.go:261      Auto ILM enable success.
2021-06-14T11:23:16.042+0200    INFO    [index-management.ilm]  ilm/std.go:160  ILM policy filebeat exists already.
2021-06-14T11:23:16.042+0200    INFO    [index-management]      idxmgmt/std.go:401      Set setup.template.name to '{filebeat-7.13.1 {now/d}-000001}' as ILM is enabled.
2021-06-14T11:23:16.042+0200    INFO    [index-management]      idxmgmt/std.go:406      Set setup.template.pattern to 'filebeat-7.13.1-*' as ILM is enabled.
2021-06-14T11:23:16.042+0200    INFO    [index-management]      idxmgmt/std.go:440      Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.13.1 {now/d}-000001} as ILM is enabled.
2021-06-14T11:23:16.042+0200    INFO    [index-management]      idxmgmt/std.go:444      Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2021-06-14T11:23:16.237+0200    INFO    template/load.go:228    Existing template will be overwritten, as overwrite is enabled.
2021-06-14T11:23:17.656+0200    INFO    [add_cloud_metadata]    add_cloud_metadata/add_cloud_metadata.go:101    add_cloud_metadata: hosting provider type not detected.
2021-06-14T11:23:18.134+0200    INFO    template/load.go:131    Try loading template filebeat-7.13.1 to Elasticsearch
2021-06-14T11:23:27.047+0200    INFO    template/load.go:123    template with name 'filebeat-7.13.1' loaded.
2021-06-14T11:23:27.047+0200    INFO    [index-management]      idxmgmt/std.go:297      Loaded index template.
2021-06-14T11:23:28.065+0200    INFO    [index-management.ilm]  ilm/std.go:135  Index Alias filebeat-7.13.1 successfully created.
Index setup finished.
Loading dashboards (Kibana must be running and reachable)
2021-06-14T11:23:28.065+0200    INFO    kibana/client.go:119    Kibana url: https://14f2a***dd13af1.us-west1.gcp.cloud.es.io:443
2021-06-14T11:23:31.681+0200    INFO    kibana/client.go:119    Kibana url: https://14f2a***dd13af1.us-west1.gcp.cloud.es.io:443
2021-06-14T11:23:56.173+0200    ERROR   instance/beat.go:989    Exiting: 1 error: error loading index pattern: returned 408 to import file: <nil>. Response: {"statusCode":408,"error":"Request Time-out","message":"Request Time-out"}
Exiting: 1 error: error loading index pattern: returned 408 to import file: <nil>. Response: {"statusCode":408,"error":"Request Time-out","message":"Request Time-out"}

I have a quite slow Internet connection (around 20 Mbps) and I saw one post saying that this error went away when trying with a faster internet connection. 20 Mbps is not that bad, it should be enough to run the setup (if the issue is related to internet speed). Also, I was working last year with an older version (around 7.6) and I did not have any problems (with the same internet connection)

Thank you !

2

Same for metricbeat but heartbeat works fine...

3

Hi @pjvilloud :slightly_smiling_face:

Your internet speed should be sufficient. Still you're getting some kind of network error that might be related to something else in the network: a firewall, some other process flooding the network with UDP packets to mention few.

Can you also share the configuration you are using and your operating system? I guess it's linux ubuntu or mac

4

Thanks @Mario_Castro for your quick answer. I'm using Windows 10 but I try with my Linux Mint distribution and I have exactly the same problem. I can share my configuration with you but it's simply the default one with cloud.auth and cloud.id set for my cloud instance.
If both Windows and Linux have the same error, it can't be a firewall issue right ?

Thanks !

5

It can be a "firewall" thing if you are trying to establish network connection between 2 different computers, one of them using AWS or GCP and you don't setup the proper network rules.

6

I'm using GCP for my cloud config, do I need to specify my IP address somewhere to allow the connection ? When using the version 7.6, it worked and I did not change the cloud configuration

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.