Auditbeat vs testing ES output

Elastic Stack Beats
21

Output config:

output.elasticsearch:
  # KEYs all expected to be found in ${path.data}/auditbeat.keystore
  hosts: ["${INGEST_URL}"]
  pipeline: auditbeat

  protocol: "${INGEST_PROTOCOL}"
  username: "${INGEST_USER}"
  password: "${INGEST_PWD}"

Just weird that 'test output' works fine through HAproxy from various wintel beats.
Tried from another Lintel client behind HAproxy with metricbeat running:

# /usr/share/metricbeat/bin/metricbeat test output -c /etc/metricbeat/metricbeat.yml
elasticsearch: https://<redacted>:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: <redacted>
    dial up... OK
  TLS...
    security... WARN server's certificate chain verification is disabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
  version: 7.6.0
22

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.