Error while connection to Elasticsearch (503, The server refuse to browse the page)

Elastic Stack Beats
1

Hi,

I am having trouble sending data from Heartbeat to Elasticsearch (both version 7.3). On the same server runs an instance of apm-server which makes no trouble, so I used the same configuration for elasticsearch giving the server (real IP 192.1.9.211, not localhost), username
and password. Still I get

2020-03-14T11:41:45.424Z	DEBUG	[elasticsearch]	elasticsearch/client.go:723	Ping request failed with: 503 Service Unavailable: <HTML><HEAD><TITLE>ERROR</TITLE></HEAD><BODY>
<H1>ERROR</H1>

<HR><UL>
The server refuse to browse the page.<BR>
The URL or other input may not be correct. Please confirm the value.<BR>
<BR>
<UL>
URL: <b>http://192.1.9.211:9200/</b><br>
ERROR: <b>CONNECT(192.1.9.211:9200)/connect: Connection timed out</b><br>
</UL>
</UL>

<HR><DIV ALIGN=right>Powered by F-Secure</DIV>
</BODY></HTML>

2020-03-14T11:41:46.468Z	INFO	pipeline/output.go:93	Attempting to reconnect to backoff(elasticsearch(http://192.1.9.211:9200)) with 1 reconnect attempt(s)
2020-03-14T11:41:46.468Z	DEBUG	[elasticsearch]	elasticsearch/client.go:719	ES Ping(url=http://192.1.9.211:9200)

as reponse. I am running heartbeat with sudo, since otherwise it doesn't seem to work to create a tcp connection. When starting heartbeat with -d '*' I see that the IP I want to ping seems to work.
In the elasticsearch.yml the host is given as

network.host: 192.1.9.211

Hope anyone knows where the problem is. Thanks!

2

Something here is different. It seems that you're hitting an F-Secure device instead of elasticsearch. Furthermore, given the timeout error it seems the F-Secure device cannot reach Elasticsearch.

Can you ping Elasticsearch from the same box as heartbeat using say cURL?

3

Hi,

thanks for answering. You are right, the problem turned out having nothing to do with Elasticsearch itself but a network proxy that was in between Heartbeat and Elasticsearch. Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.