Hello
Just installed and configured packetbeat (7.6.2) on the elastic server (7.6.2).
filebeat and metricbeat also run on the same server(s), and of course elasticsearch.
packetbeat is not sending any data, so I wanted to debug.
when trying to debug with
packetbeat -e
Getting the following messages
[root@ELSSERVER packetbeat]# packetbeat -e
2020-06-24T13:11:23.176+1000 INFO instance/beat.go:622 Home path: [/usr/share/packetbeat] Config path: [/etc/packetbeat] Data path: [/var/lib/packetbeat] Logs path: [/var/log/packetbeat]
2020-06-24T13:11:23.176+1000 INFO instance/beat.go:630 Beat ID: 410ec1f1-81ae-4363-b9b3-05aad70ffed9
2020-06-24T13:11:23.181+1000 INFO instance/beat.go:380 packetbeat stopped.
2020-06-24T13:11:23.181+1000 ERROR instance/beat.go:933 Exiting: data path already locked by another beat
Exiting: data path already locked by another beat
I searched the forum and generally the net, and could not find a solution.
packetbeat.yml -->
- type: http
# Configure the ports where to listen for HTTP traffic. You can disable
# the HTTP protocol by commenting out the list of ports.
ports: [80, 8080, 8000, 5000, 8002, 9200]
send_request: true
include_body_for: ["application/json", "x-www-form-urlencoded"]
- type: tls
# Configure the ports where to listen for TLS traffic. You can disable
# the TLS protocol by commenting out the list of ports.
ports:
- 443 # HTTPS
- 993 # IMAPS
- 995 # POP3S
- 5223 # XMPP over SSL
- 8443
- 8883 # Secure MQTT
- 9243 # Elasticsearch
output.logstash:
# The Logstash hosts
hosts: ["IP:5144"]
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
What is missing/wrong?
Thanks!
