Anyone tried installing beats with managed AWS ES?


(piyush) #1

Filebeat & Topbeat are getting connection error while trying to connect AWS ES. The logs says, it's adding port (9200) to the host address whereas managed ES endpoint doesn't have a port.


(Andrew Kroh) #2

If the port isn't specified then Beats default to 9200. So if you wanted to use port 80 then set hosts: ['myhost:80'].


(piyush) #3

But i don't want to use port at all. will it allow that?


(Andrew Kroh) #4

If you don't specify a port, then 9200 will be used. https://www.elastic.co/guide/en/beats/topbeat/current/elasticsearch-output.html#hosts-option


Amazon Elasticsearch Service without port
(piyush) #5

Ok, thanks for confirming. We might need that feature in upcoming release. :slight_smile:

Now I am trying beat->logstash->ES

Thanks & Regards


(Steffen Siering) #6

Which feature? What's wrong with port 80? Even managed ES must open a port (HTTP default port is 80 btw.), otherwise you won't be able to send or query data.

The default port 9200 can be overwritten by the 'port' option (still works) or in the URL given to hosts list.

In general default port of elasticsearch is 9200 and default config points to standard default port of elasticsearch. If managesd AWS ES deviates from any defaults, you have to adjust beats configs yourself (never used manages AWS ES myself).


(piyush) #7

I agree about default ports but managed ES gives only an endpoint in the
form of URL, without port. It manages ports internally...

The feature I said was to allow host as plain string in case port is not
given.

I am also creating my own cluster now, not working on managed ES.


(Steffen Siering) #8

check out elastic cloud. It's managed ES instance hosted on Amazon EC2. Works great for me.


(I Gaskin) #9

I've had success using beats->logstash->ES. If you were thinking of revisiting Amazon's ES service, you can specify your endpoint (no ports), in the "hosts" field with the logstash-output-amazon_es plugin
https://github.com/awslabs/logstash-output-amazon_es


(Mike Gingerich) #10

I'd like to get the beats->logstash->ES combo to work, but am stuck on the logstash-output-amazon_es plugin.

Specifically, it gets this error when executing the build command:
ubuntu@ip-xxx-xxx-xxx-xxx:~$ cd logstash-output-amazon_es/
ubuntu@ip-xxx-xxx-xxx-xxx:~/logstash-output-amazon_es$ gem build logstash-output-amazon_es.gemspec
Invalid gemspec in [logstash-output-amazon_es.gemspec]: undefined method `metadata=' for #<Gem::Specification name=logstash-output-amazon_es version=1.0>
ERROR: Error loading gemspec. Aborting.

Any tips? Which version(s) of logstash and amazon ES and logstash-output-amazon_es plugin worked for you?


(Steffen Siering) #11

maybe someone in logstash forum can help you. As this plugin is maintained by amazon, I don't really have any experience with it.


(system) #12