ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(https://<ES_URL>)): 401 Unauthorized

Elastic Stack Beats
1

Hello,

AWS Elasticsearch Version: 7.1
aws-es-proxy-0.9-windows-amd64.exe
Kibana OSS 7.1.1
Filebeat OSS 7.1.1

This is a production issue on our windows server, we suddenly got this error from filebeat logs:

2020-04-13T06:41:59.305-0400 ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(https://<ES_URL>)): 401 Unauthorized:

This causing our Elasticsearch not collecting logs.

config/kibana.yml

server.port: 5609
server.host: ""
server.basePath: "/7.1/kibana"
elasticsearch.url: "http://127.0.0.1:9230/"
elasticsearch.ssl.verificationMode: none

config/filebeat.yml

username: ""
password: ""
setup.ilm.enabled: false

Other filebeat config wasn't mention here.

Could someone please help me find out and understand the reason of the issue.

2

Please someone can help me in this issue.

3

Please help me on this.

4

It seems like you are using a non-standard proxy, so I am not sure how much help you will be able to get here. I would recommend contacting the creator of the proxy.

5

We tried to reinstall the filebeat service, and it starts collecting logs again. Though we may lose some of our data by doing so.

Here's what we can see now in filebeat logs:

|2020-04-14T04:45:32.342-0400|INFO|log/harvester.go:254|Harvester started for file: d:\logs\Audit.txt.0|
|2020-04-14T04:45:32.342-0400|INFO|log/harvester.go:254|Harvester started for file: d:\apps\web\oauth\logs\OauthAudit.txt.0|
|2020-04-14T04:45:32.372-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'm' in string escape code|
|2020-04-14T04:45:32.377-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'g' in string escape code|
|2020-04-14T04:45:32.378-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'w' in string escape code|
|2020-04-14T04:45:32.392-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'w' in string escape code|
|2020-04-14T04:45:32.397-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'a' in string escape code|
|2020-04-14T04:45:32.397-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'j' in string escape code|
|2020-04-14T04:45:32.398-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'c' in string escape code|
|2020-04-14T04:45:32.399-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 's' in string escape code|
|2020-04-14T04:45:32.400-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'j' in string escape code|
|2020-04-14T04:45:32.400-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'e' in string escape code|
|2020-04-14T04:45:32.400-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'j' in string escape code|
|2020-04-14T04:45:32.403-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'p' in string escape code|
|2020-04-14T04:45:32.405-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'j' in string escape code|
|2020-04-14T04:45:32.410-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'a' in string escape code|
|2020-04-14T04:45:32.416-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'm' in string escape code|

Any idea with the error?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.