Error connection Logstash

Elastic Stack Beats
,
1

Hi everyone, I started a few weeks ago to work with ELK and Filebeat in a Docker system for an university project. I have working the ELK, Kibana detect everything, including Beats, now I'm configuring Filebeat to send the logs to Logstash but I have an error when Filebeat tries to send something.

ERROR [centralmgmt.event_reporter] api/event_reporter.go:90 could not send events, error: 1 error: Beat "id_number" not found

The id_number of my Filebeat and the id_number that Kibana give me when I enroll Beats are different. I read about it and I think that I can't put that number in a manual way, it's automatic, and I don't know how to resolve this.

I put my Filebeat configuration, maybe I have things wrong.

management:
  enabled: true
  period: 1m0s
  events_reporter:
    period: 30s
    max_batch_size: 1000
  access_token: (Kibana_enroll_number)
  kibana:
    protocol: http
    host: localhost:5601
    ssl: null
    timeout: 10s
    ignoreversion: true
  blacklist:
    output: console|file

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - (...)\logs\*.log
output.logstash:
  hosts: ["localhost:5000"]    < The port usually is 5044 but I put this.

Greetings.

2

Same issue here, do you find any answer ?

3

I already solved my problem, I honestly don't understand exactly the error, maybe I modified too much without knowing, I started again, I enroll again and without touching anything of the Filebeat configuration (.yml files), it worked, I configured the input and output of the Beat in Kibana and I had no more problems.

In Kibana, in the Beat section, you have the "Enrolled Beats" and the "Configuration tags", the last one is used to create configurations of the output, input, modules, etc. (Configuration blocks) and use them as a tag for enrolled beats.

I think I didn't change anything else.

I use this command for send the logs with Filebeat and it works, I see in Kibana the Logs.

C:\Program Files\Filebeat> ./filebeat -c filebeat.yml -e

Greetings and good luck.

(My English is not the best :slight_smile: )

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.