Failed to connect to backoff(elasticsearch(http://172.18.158.52:9200))

Elastic Stack Beats
1

I currently have two servers which are as follows:

172.18.158.52 where I installed elasticsearch and kibana
172.18.158.49 where I installed filebeat

Filebeat is able to recover the data except that I have this error in the logs:

{"log.level":"error","@timestamp":"2024-04-15T15:01:26.190+0200","log.logger":"publisher_pipeline_output","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run","file.name":"pipeline/client_worker.go","file.line":148},"message":"Failed to connect to backoff(elasticsearch(http://172.18.158.52:9200)): Get \"http://172.18.158.52:9200\": EOF","service.name":"filebeat","ecs.version":"1.6.0"

Can you help me please

2

After this error, I have this line right after

{"log.level":"info","@timestamp":"2024-04-16T14:51:39.285+0200","log.logger":"publisher_pipeline_output","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run","file.name":"pipeline/client_worker.go","file.line":139},"message":"Attempting to reconnect to backoff(elasticsearch(http://172.18.158.52:9200)) with 249 reconnect attempt(s)","service.name":"filebeat","ecs.version":"1.6.0"}
3

This error means that your filebeat cannot connect to Elasticsearch.

Is your Elasticsearch using http or https? If it is using https, then you need to change your filebeat configuration to use https as well.

If it is using http, then you may have a network issue that you need to troubleshoot and solve before using filebeat and elasticsearch.

4

Thank you Leandro for your response.

If I want to see if Elasticsearch works on the browser, I have to put https://172.18.158.52:9200 and it works.

If I want to access Kibana, I have to put http://172.18.158.52:5601 and it works.

In my filebeat.yml file I activated the "https" protocol. I restarted filebeat and now I have this error in the logs:

{"log.level":"error","@timestamp":"2024-04-16T15:26:38.952+0200","log.logger":"esclientleg","log.origin":{"function":"github.com/elastic/elastic-agent-libs/transport/httpcommon.(*HTTPTransportSettings).RoundTripper.LoggingDialer.func2","file.name":"transport/logging.go","file.line":38},"message":"Error dialing x509: certificate signed by unknown authority","service.name":"filebeat","network":"tcp","address":"172.18.158.52:9200","ecs.version":"1.6.0"}
5

You need to configure SSL in Filebeat as well, check the documentation.

1 Like
6

Thank you so much Leandro for your help. All it's working now.