`.
#cloud.auth:
# ================================== Outputs ===================================
# Configure what output to use when sending the data collected by the beat.
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["http://192.168.100.50:9200"]
# Protocol - either `http` (default) or `https`.
protocol: "http"
# Authentication credentials - either API key or username/password.
#api_key: "id:api_key"
username: "elastic"
password: "zJo*18IY3gqAZ_bn*GpQ"
ssl:
enable: true
ca_trusted_fingerprint: "1c293074c286f65f9a5c0db80419de085b264c1341b539c54bf7032f734f3093"
# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# The Logstash hosts
#hosts: ["localhost:5044"]
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
# Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
# ================================= Processors =================================
processors:
- add_host_metadata:
when.not.contains.tags: forwarded
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
# ================================== Logging ===================================
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
#logging.level: debug
# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publisher", "service".
#logging.selectors: ["*"]
# ============================= X-Pack Monitoring ==============================
# Filebeat can export internal metrics to a central Elasticsearch monitoring
# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
# reporting is disabled by default.
# Set to true to enable the monitoring reporter.
#monitoring.enabled: false
# Sets the UUID of the Elasticsearch cluster under which monitoring data for this
# Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
# is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.
#monitoring.cluster_uuid:
# Uncomment to send the metrics to Elasticsearch. Most settings from the
# Elasticsearch output are accepted here as well.
# Note that the settings should point to your Elasticsearch *monitoring* cluster.
# Any setting that is not set is automatically inherited from the Elasticsearch
# output configuration, so if you have the Elasticsearch output configured such
# that it is pointing to your Elasticsearch monitoring cluster, you can simply
# uncomment the following line.
#monitoring.elasticsearch:
# ============================== Instrumentation ===============================
# Instrumentation support for the filebeat.
#instrumentation:
# Set to true to enable instrumentation of filebeat.
#enabled: false
# Environment in which filebeat is running on (eg: staging, production, etc.)
#environment: ""
# APM Server hosts to report instrumentation results to.
#hosts:
# - http://localhost:8200
# API Key for the APM Server(s).
# If api_key is set then secret_token will be ignored.
#api_key:
# Secret token for the APM Server(s).
#secret_token:
# ================================= Migration ==================================
# This allows to enable 6.7 migration aliases
#migration.6_to_7.enabled: true
```
---
### Author:  [@Ugo\_Sangiorgi](https://discuss.elastic.co/u/Ugo_Sangiorgi)
#### Post date: [August 3, 2022, 5:00pm UTC](https://discuss.elastic.co/t/error-on-filebeat/311330/4 "2022-08-03T17:00:03Z")
Is Elasticsearch reachable in the address you are using? What is the output of `curl http://192.168.100.50:9200` ?
---
### Author:  [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)
#### Post date: [August 3, 2022, 5:08pm UTC](https://discuss.elastic.co/t/error-on-filebeat/311330/5 "2022-08-03T17:08:48Z")
curl: (52) Empty reply from server
---
### Author:  [@Ugo\_Sangiorgi](https://discuss.elastic.co/u/Ugo_Sangiorgi)
#### Post date: [August 3, 2022, 5:26pm UTC](https://discuss.elastic.co/t/error-on-filebeat/311330/6 "2022-08-03T17:26:44Z")
There is your problem, Elasticsearch is not up
---
### Author:  [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)
#### Post date: [August 3, 2022, 5:35pm UTC](https://discuss.elastic.co/t/error-on-filebeat/311330/7 "2022-08-03T17:35:42Z")
The elasticsearch service its working
I run systemctl status elasticsearch.service and the response is active (running)
---
### Author:  [@Ugo\_Sangiorgi](https://discuss.elastic.co/u/Ugo_Sangiorgi)
#### Post date: [August 3, 2022, 6:53pm UTC](https://discuss.elastic.co/t/error-on-filebeat/311330/8 "2022-08-03T18:53:49Z")
Maybe Elasticsearch is not bound to `192.168.100.50`, therefore only responding to `localhost` ?
What is your `elasticsearch.yml` configured, specifically the `network.host` (which defaults to `_local_`) ?
> **[Networking | Elasticsearch Guide \[8.3\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html#common-network-settings)**
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 3, 2022, 11:32pm UTC](https://discuss.elastic.co/t/error-on-filebeat/311330/9 "2022-08-03T23:32:35Z")
Loos like you are trying to use ssl so you should use `https`
> [@VitorBarroso](#):
>
> curl: (52) Empty reply from server
That is often the response when sending http to https port so try
`curl -insecure -u "elastic:zJo*18IY3gqAZ_bn*GpQ" https://192.168.100.50:9200`
and you should reset your password since you posted it here
So try this..
```auto
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["https://192.168.100.50:9200"]