Configure TCP input via Central Management

Elastic Stack Beats
1

I can setup an input in Filebeat as a TCP listener in the config file, but when I enroll it with Beats Central Management, my configuration is erased in favor of the UI configuration. However, I can't see any way to configure a TCP input through the UI. Is it true that I can not use TCP inputs when using Beats Central Management, or am I missing something? Thanks!

2

Hello, thanks for reaching out about central management. Could you specify filebeat.inputs in central management? Once specified, it should reload automatically.

Thanks.

3

I've done that. There is no choice in the user interface to set that input to TCP mode rather than tailing a file.

4

I was able get it working through the UI, but it's a bit of a hack. It's not able to be saved without a path, and it's also not clear where the "Other Config Settings" will end up in the final merged confioguration, but with some trial and error, it seems to be working.

Capture
Capture.PNG467×668 17.4 KB

I also did get it working by editing each filebeat.yml (bypassing the central config). I had missed the comment that gets injected into that file after enrollment describing how to add unsupported central management configuration to it.

5

I tried your fix but I'm not receiving any logs on udp. My application is sending logs over udp on: syslog://127.0.0.1:9001

TCP

Sep 13 16:17:49 server1.com filebeat[5682]: 2019-09-13T16:17:49.123+0200 INFO [tcp input] tcp/input.go:103 Starting TCP input {"address": "localhost:9001"}
Sep 13 16:17:49 server1.com filebeat[5682]: 2019-09-13T16:17:49.124+0200 INFO [tcp] tcp/server.go:84 Started listening for TCP connection {"address": "localhost:9001"}

#netstat -tnlp | grep filebeat
tcp 0 0 127.0.0.1:9001 0.0.0.0:* LISTEN 5682/filebeat

UDP

Sep 13 16:21:36 server1.com filebeat[5961]: 2019-09-13T16:21:36.275+0200 INFO udp/input.go:102 Starting UDP input
Sep 13 16:21:36 server1.com filebeat[5961]: 2019-09-13T16:21:36.275+0200 INFO [udp] udp/server.go:81 Started listening for UDP connection {"address": "localhost:9001"}

#netstat -lptu | grep filebeat
udp 0 0 server1.com:9001 : 5961/filebeat