My filebeat is in the client server but in same domain and ELK stack in another server with their default ports.
elasticsearch.yml
xpack.security.enabled : false
discovery.type: single-node
network.host: 16.XXX.YYY.ZZZ
http.port: 9200
logstash.yml
http.host: "16.202.14.116"
http.port: 9600-9700
logstash.conf
input {
beats {
type => beats
port =>5044
host => "16.XXX.YYY.ZZZ"
}
}
filter {
grok {
match => ["message", '%{IPV4:remoteIP}\s+%{IPV4:localIP}\s+%{INT:throughtputData:int}\s+%{INT}\s+%{IPV4:remoteHostIP}\s+%{DATA:httpProtocol}\s+%{DATA:remoteLogicalUserName}\s+%{DATA:requestMethod}\s+%{DATA:port}\s+%{DATA:queryString}\s+%{DATA:requestMethod2}\s+%{DATA:requestURI}\s+%{DATA:requestProtocol2}\s+%{INT:requestStatusCode}\s+%{DATA:userSessionID}\s+\[%{HTTPDATE:logTimeStamp}\]\s+%{DATA:remoteUser}\s+%{DATA:requestedURL}\s+%{DATA:serverName}\s+%{INT:timeTakenInMilliSec:int}\s+%{NUMBER:timeTakenInSec}\s+default\s+task-%{INT:taskID:int}\s+"%{DATA:authorization}"\s+"%{DATA:contentType}"\s+"%{DATA:referer}"\s+"%{DATA:userAgent}"\s+"%{DATA:cookie}"\s+"%{DATA:setCookie}"' ]
}
if "_grokparsefailure" in [tags]{
drop {}
}
if "_groktimeout" in [tags]{
drop {}
}
date {
match => ["logTimeStamp" ,"dd/MMM/yyyy:HH:mm:ss Z" ]
}
mutate{
remove_field => ["message","host","input","type","@version","prospector","beat","garbageData","offset"]
}
}
output {
elasticsearch {
hosts => ["16.XXX.YYY.ZZZ:9200"]
index => "mdcp-contact-%{+YYYY.MM.dd}"
}
}
filebeat.yml ( in remote server)
output.logstash:
hosts: ["16.xxx.yyy.zzz:5044"]
When I try file beat with same server where ELK is installed, with same config, its working as expected . when running from remote server (but in same intranet/domain), it gives the following error:
2019-07-02T11:49:53.923Z INFO pipeline/output.go:95 Connecting to backoff(async(tcp://16.202.14.116:5044))
2019-07-02T11:50:22.902Z INFO [monitoring] log/log.go:141 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":40,"time":{"ms":46}},"total":{"ticks":260,"time":{"ms":273},"value":260},"user":{"ticks":220,"time":{"ms":227}}},"info":{"ephemeral_id":"7c5d9a0b-e849-4520-a2a7-ddf8da11ffd1","uptime":{"ms":30021}},"memstats":{"gc_next":7921648,"memory_alloc":4541256,"memory_total":11893096,"rss":19337216}},"filebeat":{"events":{"active":1535,"added":1538,"done":3},"harvester":{"open_files":20,"running":20,"started":20}},"libbeat":{"config":{"module":{"running":0}},"output":{"type":"logstash"},"pipeline":{"clients":1,"events":{"active":1516,"filtered":22,"published":1516,"total":1538}}},"registrar":{"states":{"current":3,"update":3},"writes":{"success":4,"total":4}},"system":{"cpu":{"cores":24},"load":{"1":1.64,"15":0.72,"5":1.22,"norm":{"1":0.0683,"15":0.03,"5":0.0508}}}}}}
2019-07-02T11:50:24.924Z ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://16.202.14.116:5044)): dial tcp 16.202.14.116:5044: i/o timeout
2019-07-02T11:50:24.924Z INFO pipeline/output.go:93 Attempting to reconnect to backoff(async(tcp://16.202.14.116:5044)) with 1 reconnect attempt(s)
2019-07-02T11:50:52.901Z INFO [monitoring] log/log.go:141 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":50,"time":{"ms":10}},"total":{"ticks":290,"time":{"ms":28},"value":290},"user":{"ticks":240,"time":{"ms":18}}},"info":{"ephemeral_id":"7c5d9a0b-e849-4520-a2a7-ddf8da11ffd1","uptime":{"ms":60021}},"memstats":{"gc_next":7921648,"memory_alloc":4930824,"memory_total":12282664,"rss":86016}},"filebeat":{"harvester":{"open_files":20,"running":20}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":1516,"retry":1516}}},"registrar":{"states":{"current":3}},"system":{"load":{"1":1.57,"15":0.74,"5":1.24,"norm":{"1":0.0654,"15":0.0308,"5":0.0517}}}}}}
2019-07-02T11:50:56.925Z ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://16.202.14.116:5044)): dial tcp 16.202.14.116:5044: i/o timeout
2019-07-02T11:50:56.925Z INFO pipeline/output.go:93 Attempting to reconnect to backoff(async(tcp://16.202.14.116:5044)) with 2 reconnect attempt(s)
2019-07-02T11:51:22.901Z INFO [monitoring] log/log.go:141 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":60,"time":{"ms":13}},"total":{"ticks":310,"time":{"ms":26},"value":310},"user":{"ticks":250,"time":{"ms":13}}},"info":{"ephemeral_id":"7c5d9a0b-e849-4520-a2a7-ddf8da11ffd1","uptime":{"ms":90021}},"memstats":{"gc_next":7921648,"memory_alloc":5260664,"memory_total":12612504,"rss":53248}},"filebeat":{"harvester":{"open_files":20,"running":20}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":1516,"retry":1516}}},"registrar":{"states":{"current":3}},"system":{"load":{"1":1.59,"15":0.76,"5":1.27,"norm":{"1":0.0663,"15":0.0317,"5":0.0529}}}}}}
Please help on this !