Cannot index event publisher.Event


Hello World!

I'm using Elastic stack 6.6.1/6.7.1 and while following Enroll Beats in central management | Filebeat Reference [6.6] | Elastic, I've noticed few of beats have following WARN in /var/logfilebeat/filebeat:

2019-02-11T16:56:45.967Z WARN elasticsearch/client.go:523 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbf10883339619143, ext:45895108537813, loc:(*time.Location)(0x21be580)}, Meta:common.MapStr{"pipeline":"filebeat-6.6.0-system-auth-pipeline"}, Fields:common.MapStr{"event":common.MapStr{"dataset":"system.auth"}, "prospector":common.MapStr{"type":"log"}, "input":common.MapStr{"type":"log"}, "fileset":common.MapStr{"module":"system", "name":"auth"}, "host":common.MapStr{"name":"kibana17"}, "offset":398726, "log":common.MapStr{"file":common.MapStr{"path":"/var/log/auth.log"}}, "message":"Feb 11 16:56:44 kibana17 sshd[31472]: Received disconnect from port 49328:11: Bye Bye [preauth]", "beat":common.MapStr{"hostname":"kibana17", "version":"6.6.0", "name":"kibana17"}, "source":"/var/log/auth.log"}, Private:file.State{Id:"", Finished:false, Fileinfo:(*os.fileStat)(0xc421bc7790), Source:"/var/log/auth.log", Offset:398835, Timestamp:time.Time{wall:0xbf1087a936e4817b, ext:45343066787428, loc:(*time.Location)(0x21be580)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x61550, Device:0x801}}}, Flags:0x1} (status=400): {"type":"illegal_argument_exception","reason":"pipeline with id [filebeat-6.6.0-system-auth-pipeline] does not exist"}

Please advise.

(Len Rugen) #2

Same issue....

(Subhas Takhellambam) #4

I am having the same issue. Any update plz?

(Steffen Siering) #5

Have you run filebeat setup after filebeat enroll?


I ran following command before encountering above error and creating new topic to discuss:

# filebeat setup --pipelines
# echo $?
(Pier-Hugues Pellerin) #7

Looking at the issue I see that the pipeline is not correctly installed, we are working to automate the installation of pipelines, dashboard and template via the UI. But for now you will have to run.

./filebeat setup  --pipelines --modules system   
# filebeat setup --pipelines --modules system
Exiting: (assert) config is nil
Trace:goroutine 1 [running]:
runtime/debug.Stack(0x1785394, 0xb, 0xc4205c3360)
	/usr/local/go/src/runtime/debug/stack.go:24 +0xa7, 0xc4200b8c60, 0xc42058b520, 0x16, 0xc42017aba0, 0xc420211620)
	/go/src/ +0x66, 0xc4200b8c60, 0x4, 0xc420245200)
	/go/src/ +0x3d*Config).Unpack(0x0, 0x156f620, 0xc42000c1c0, 0xc4202783c0, 0x4, 0x4, 0x101, 0xc42000c1c0)
	/go/src/ +0x1fb*Config).Unpack(0x0, 0x156f620, 0xc42000c1c0, 0x14e9a11, 0x160bc20)
	/go/src/ +0x63, 0x160bc20, 0x188dcc0, 0x167a7c0, 0x188dc00, 0x14e9a03)
	/go/src/ +0x88, 0xc42023a790, 0xc4204633a8, 0x0, 0x0, 0x0)
	/go/src/ +0x43, 0x5, 0xc42048e320, 0x5)
	/go/src/ +0x43*Filebeat).setupPipelineLoaderCallback.func1(0x0, 0x17df448, 0x1866100)
	/go/src/ +0x40*Beat).Setup.func1(0xc4200deb40, 0x17df448, 0x1000000, 0x0, 0x0)
	/go/src/ +0x37c*Beat).Setup(0xc4200deb40, 0x17df448, 0x1000000, 0x0, 0x0)
	/go/src/ +0x66, 0xc42023a580, 0x0, 0xb)
	/go/src/ +0x269*Command).execute(0xc42022c6c0, 0xc420274200, 0xb, 0x10, 0xc42022c6c0, 0xc420274200)
	/go/src/ +0x2c6*Command).ExecuteC(0xc4200f8280, 0x0, 0xc4200f8280, 0x178276f)
	/go/src/ +0x2e4*Command).Execute(0xc4200f8280, 0xc4204e7f78, 0xc4200ae058)
	/go/src/ +0x2b
	/go/src/ +0x2f


also, per my early comment, there was no error running without --module system part.

(system) closed #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.