ELK running on VM, not able to send logs from physical machine

[mvasuraja (Raja)]

I am running Ubuntu 22.04 on my physical machine with IP 10.180.7.188. I am also running a Ubuntu 22.04 Virtual machine with IP 10.180.5.246. I have installed the ELK version 7.6.2 on the VM.

I have installed filebeat version 7.6.2 on both the physical machine and the VM. I am able to get the system logs through filebeat generated on the VM into the ELK stack and able to see it on Kibana. But I am not able to send logs from the physical machine to the VM. I know this for sure because I have stopped filebeat on the VM and refresh the Kibana view, I am not able to see fresh logs getting displayed.

The VM is created using Virtualbox, with the network being attached to a Bridge adapter with name eno1.

I am able to ping between the two IPs. I am able to get the kibana view on the physical machine as well, by typing http://10.180.5.246:5601

I have this in my filebeat.yml

setup.kibana:
  host: "http://10.180.5.246:5601"
  username: "****"
  password: "****"

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["http://10.180.5.246:9200"]
  username: "****"
  password: "****"

What do I do to get the logs pumped into the VM?

Thanks & Regards,

[rugenl (Len Rugen)]

Check the firewall rules of the VM, you probably need to open the ports. Also check that the services are listening on more than just localhost.

[mvasuraja (Raja)]

@rugenl

Thanks for the reply.

I have disabled the firewall on my VM.

I have this in my elasticsearch.yml:

network.host: 0.0.0.0

I have also tried with

transport.host:localhost 
transport.tcp.port: 9300
http.port:9200
network.host: 0.0.0.0

Anything else that needs to be checked/ modified?

As mentioned I am able to send logs through filebeat running on the local (virtual) machine but I want logs from a physical machine also to reach the server.

I am a newbie when it comes to these so request you to guide me through.

Thanks

[rugenl (Len Rugen)]

A second physical machine, not your virtual box host? Start with port testing, either the standard curl test or nmap to port 9200, first from your virtual box host to the guest, then from outside. This isn't an elasticsearch issue, it's lab networking, doesn't matter the apps involved. And it's often not easy.

[mvasuraja (Raja)]

Find below screenshot taken on my physical machine. I am able to run curl.