Failed to install filebeat RPM on EL5 Linux machine

I am trying to install filebeat-5.0.1 and getting the following error:

error: /petavm/abpapp1/inf/petavm2/Beats/packages/filebeat-5.0.1-x86_64.rpm: Header V4 RSA/SHA512 signature: BAD, key ID d88e42b4
error: /petavm/abpapp1/inf/petavm2/Beats/packages/filebeat-5.0.1-x86_64.rpm cannot be installed

Any idea what the problem is?


Did you follow the instructions from here? Specifically did you install the public signing key used by Elastic to sign the packages (key id: d88e42b4)?


I didn't understand your answer @ all.
I am using an RPM that I downloaded from Elastic to Install the Filebeat. (5.0.1)
I already installed it in various machine and it is working with no issues.
In a specific machine I suddenly got that error. I didn't do nothing different from other host that I installed Filebeat on them.
I am trying to understand what is different on that machine?


I did the process, created the elastic.repo file as indicated but it didn't solve the problem.

Still getting the same error during running the installation using the rpm.

Did you run the following command (step 1 of the instructions)?

sudo rpm --import


Yes, I run it but still the same error.

Anyway, I am trying to understand why do I need it , as I am using the rpm for Installation and not having yum commands.


You need to have the signing key installed for the signature check to pass.

What's the SHA sum of the file that you have? Perhaps it's corrupt.

What OS version are you using?

petavm2@hbdchl016!SAT:petavm2> uname -r

petavm2@hbdchl016!SAT:petavm2/Beats/packages> cksum filebeat-5.0.1-x86_64.rpm
539366994 8649844 filebeat-5.0.1-x86_64.rpm

What's in /etc/redhat-release? What version of rpm (rpm --version)?

The file is not corrupt.

You are using el5 and Beats only support el6 and el7. Probably the version of rpm on your machine cannot validate the signature due to bug 436812.

I understand.

We will need to upgrade the redhat version.

Thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.