ArcSight module setup failed.. kibanaclient - Error when executing Kibana client request

(Hoon Cho) #1

version : Elastic stack 6.5.4 (elasticsearch, logstash, kibana)

run below setup command but kibanaclient error like this.

[root@sec-es01-dc1 ~]# /usr/share/logstash/bin/logstash --modules arcsight --setup \
-M "arcsight.var.inputs=smartconnector" \
-M "arcsight.var.input.smartconnector.port=7001" \
-M "arcsight.var.elasticsearch.hosts=elastic-node01:9200" \
-M "arcsight.var.elasticsearch.username=elastic" \
-M "arcsight.var.elasticsearch.password=mypassword" \
-M "arcsight.var.kibana.host=elastic-node01:5601" \
-M "arcsight.var.kibana.scheme=https" \
-M "arcsight.var.kibana.username=kibana" \
-M "arcsight.var.kibana.password=mypassword" \
-M "arcsight.var.kibana.ssl.enabled=true" \
-M "arcsight.var.kibana.ssl.certificate=/usr/share/elasticsearch/certs/es-kibana/es-kibana.crt" \
-M "arcsight.var.kibana.ssl.key=/usr/share/elasticsearch/certs/es-kibana/es-kibana_p8.key"

...
[INFO ] 2019-02-13 17:51:40.816 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] modulelicensechecker - The arcsight module License OK
[INFO ] 2019-02-13 17:51:40.851 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] modulescommon - Setting up the arcsight module
[ERROR] 2019-02-13 17:51:41.201 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] kibanaclient - Error when executing Kibana client request {:error=>#<Manticore::ClientProtocolException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target>}
[ERROR] 2019-02-13 17:51:41.293 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] kibanaclient - Error when executing Kibana client request {:error=>#<Manticore::ClientProtocolException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target>}
[ERROR] 2019-02-13 17:51:41.441 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] sourceloader - Could not fetch all the sources {:exception=>LogStash::ConfigLoadingError, :message=>"Failed to import module configurations to Elasticsearch and/or Kibana. Module: arcsight has Elasticsearch hosts: ["172.30.50.201:9200"] and Kibana hosts: ["172.30.50.201:5601"]", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:108:in block in pipeline_configs'", "org/jruby/RubyArray.java:1734:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:54:in pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source/modules.rb:14:inpipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:61:in block in fetch'", "org/jruby/RubyArray.java:2481:incollect'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:60:in fetch'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:150:inconverge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:101:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:362:inblock in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in block in initialize'"]} [ERROR] 2019-02-13 17:51:41.448 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - An exception happened when converging configuration {:exception=>RuntimeError, :message=>"Could not fetch the configuration, message: Failed to import module configurations to Elasticsearch and/or Kibana. Module: arcsight has Elasticsearch hosts: [\"172.30.50.201:9200\"] and Kibana hosts: [\"172.30.50.201:5601\"]", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/agent.rb:157:inconverge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:101:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:362:inblock in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}
[INFO ] 2019-02-13 17:51:41.661 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}

kibana.log is below

{"type":"error","@timestamp":"2019-02-13T08:51:41Z","tags":["connection","client","error"],"pid":2637419,"level":"error","error":{"message":"140354352924544:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/s3_pkt.c:1498:SSL alert number 46\n140354352924544:error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure:../deps/openssl/openssl/ssl/s3_pkt.c:1216:\n","name":"Error","stack":"Error: 140354352924544:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/s3_pkt.c:1498:SSL alert number 46\n140354352924544:error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure:../deps/openssl/openssl/ssl/s3_pkt.c:1216:\n"},"message":"140354352924544:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/s3_pkt.c:1498:SSL alert number 46\n140354352924544:error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure:../deps/openssl/openssl/ssl/s3_pkt.c:1216:\n"}
{"type":"error","@timestamp":"2019-02-13T08:54:09Z","tags":["connection","client","error"],"pid":2637419,"level":"error","error":{"message":"socket hang up","name":"Error","stack":"Error: socket hang up\n at TLSSocket. (_tls_wrap.js:890:25)\n at emitOne (events.js:121:20)\n at TLSSocket.emit (events.js:211:7)\n at _handle.close (net.js:561:12)\n at Socket.done (_tls_wrap.js:360:7)\n at Object.onceWrapper (events.js:315:30)\n at emitOne (events.js:116:13)\n at Socket.emit (events.js:211:7)\n at TCP._handle.close [as _onclose] (net.js:561:12)","code":"ECONNRESET"},"message":"socket hang up"}

anyone know why this error occur?

(system) closed #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.