this is probably a user error. But I don't know how to google this one.
cat tcp.yml |grep -v "#" |uniq
id: ssh-status
name: ssh-status check
enabled: true
hosts: ["192.168.1.139:22", "192.168.1.96:22", "8.8.8.8:22"]
ipv4: true
ipv6: true
mode: any
tags: ["ssh-status"]
.138 is the elk server(self) .96 is another machine without an ssh server and .8 is google.
I should get some failures.
I don't see any failures. (I've never complained about a lack of failures before) Am I not looking in the correct spot? Is something not configured properly? What configuration files would you fine and intelligent people like to look at to help me resolve this problem of lack of failures.
I also have icmp and http configured for monitoring. Where would I see all of this?
The logs reflect what I would expect for the port 22 check.
tail -f /var/log/heartbeat/heartbeat-202212* /var/log/metricbeat/metricbeat-202212* syslog | grep -i error
{"log.level":"debug","@timestamp":"2022-12-28T16:44:31.850Z","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":210},"message":"Publish event: {\n \"@timestamp\": \"2022-12-28T16:44:31.848Z\",\n \"@metadata\": {\n \"beat\": \"heartbeat\",\n \"type\": \"_doc\",\n \"version\": \"8.5.3\"\n },\n \"state\": {\n \"down\": 1,\n \"flap_history\": [],\n \"checks\": 1,\n \"started_at\": \"2022-12-28T16:44:31.850647943Z\",\n \"duration_ms\": 0,\n \"status\": \"down\",\n \"up\": 0,\n \"ends\": {\n \"duration_ms\": 291,\n \"status\": \"up\",\n \"checks\": 2,\n \"ends\": null,\n \"id\": \"web-status-default-185599f03a4-82e1\",\n \"started_at\": \"2022-12-28T16:44:31.524233122Z\",\n \"up\": 2,\n \"down\": 0,\n \"flap_history\": null\n },\n \"id\": \"web-status-default-185599f04ea-82e2\"\n },\n \"tags\": [\n \"elk\",\n \"web-status\"\n ],\n \"tcp\": {\n \"rtt\": {\n \"connect\": {\n \"us\": 142\n }\n }\n },\n \"http\": {\n \"response\": {\n \"body\": {\n \"content\": \"{\\\"error\\\":{\\\"root_cause\\\":[{\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication credentials for REST request [/]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":[\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\",\\\"ApiKey\\\"]}}],\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication credentials for REST request [/]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":[\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\",\\\"ApiKey\\\"]}},\\\"status\\\":401}\",\n \"hash\": \"8cec75c315923dcacb5bc0be62c774dfb0411748ca96c747b5a18b915e3b8eec\",\n \"bytes\": 403\n },\n \"mime_type\": \"application/json\",\n \"headers\": {\n \"Content-Type\": \"application/json;charset=utf-8\",\n \"Content-Length\": \"403\",\n \"Www-Authenticate\": [\n \"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\",\n \"ApiKey\"\n ]\n },\n \"status_code\": 401\n },\n \"rtt\": {\n \"total\": {\n \"us\": 1808\n },\n \"write_request\": {\n \"us\": 66\n },\n \"response_header\": {\n \"us\": 1128\n },\n \"validate\": {\n \"us\": 1262\n },\n \"content\": {\n \"us\": 134\n }\n }\n },\n \"url\": {\n \"port\": 9200,\n \"full\": \"http://192.168.1.139:9200\",\n \"scheme\": \"http\",\n \"domain\": \"192.168.1.139\"\n },\n \"summary\": {\n \"up\": 0,\n \"down\": 1\n },\n \"agent\": {\n \"type\": \"heartbeat\",\n \"version\": \"8.5.3\",\n \"ephemeral_id\": \"49bc5eb8-1f29-4bca-9099-690ed7e14151\",\n \"id\": \"ee0b6046-e1ef-4b8b-adb4-7d397569c3e6\",\n \"name\": \"heartbeat\"\n },\n \"observer\": {\n \"hostname\": \"ub2204elk\",\n \"ip\": [\n \"192.168.1.139\",\n \"2600:6c40:0:7de:a00:27ff:fea4:3a3b\",\n \"fe80::a00:27ff:fea4:3a3b\"\n ],\n \"mac\": [\n \"08-00-27-A4-3A-3B\"\n ]\n },\n \"monitor\": {\n \"status\": \"down\",\n \"duration\": {\n \"us\": 1942\n },\n \"check_group\": \"e4362ff0-86ce-11ed-b535-080027a43a3b\",\n \"ip\": \"192.168.1.139\",\n \"timespan\": {\n \"lt\": \"2022-12-28T16:44:36.850Z\",\n \"gte\": \"2022-12-28T16:44:31.850Z\"\n },\n \"type\": \"http\",\n \"id\": \"web-status-8e8a549c8caee10b\",\n \"name\": \"web-status check\"\n },\n \"error\": {\n \"type\": \"io\",\n \"code\": \"BAD_HTTP_STATUS\",\n \"message\": \"Bad HTTP status Unauthorized encountered\",\n \"stack_trace\": null\n },\n \"event\": {\n \"dataset\": \"http\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n }\n}","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-12-28T18:49:47.807Z","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":210},"message":"Publish event: {\n \"@timestamp\": \"2022-12-28T18:49:47.806Z\",\n \"@metadata\": {\n \"beat\": \"heartbeat\",\n \"type\": \"_doc\",\n \"version\": \"8.5.3\"\n },\n \"observer\": {\n \"hostname\": \"ub2204elk\",\n \"ip\": [\n \"192.168.1.139\",\n \"2600:6c40:0:7de:a00:27ff:fea4:3a3b\",\n \"fe80::a00:27ff:fea4:3a3b\"\n ],\n \"mac\": [\n \"08-00-27-A4-3A-3B\"\n ]\n },\n \"url\": {\n \"port\": 9200,\n \"full\": \"http://192.168.1.139:9200\",\n \"scheme\": \"http\",\n \"domain\": \"192.168.1.139\"\n },\n \"error\": {\n \"type\": \"io\",\n \"code\": \"BAD_HTTP_STATUS\",\n \"message\": \"Bad HTTP status Unauthorized encountered\",\n \"stack_trace\": null\n },\n \"state\": {\n \"started_at\": \"2022-12-28T18:49:47.807473796Z\",\n \"checks\": 1,\n \"up\": 0,\n \"down\": 1,\n \"flap_history\": [],\n \"id\": \"web-status-default-1855a11b41f-8ea0\",\n \"duration_ms\": 0,\n \"status\": \"down\",\n \"ends\": {\n \"id\": \"web-status-default-1855a11a099-8e9f\",\n \"status\": \"up\",\n \"checks\": 3,\n \"down\": 0,\n \"flap_history\": null,\n \"ends\": null,\n \"started_at\": \"2022-12-28T18:49:42.809608798Z\",\n \"duration_ms\": 4995,\n \"up\": 3\n }\n },\n \"agent\": {\n \"name\": \"heartbeat\",\n \"type\": \"heartbeat\",\n \"version\": \"8.5.3\",\n \"ephemeral_id\": \"49bc5eb8-1f29-4bca-9099-690ed7e14151\",\n \"id\": \"ee0b6046-e1ef-4b8b-adb4-7d397569c3e6\"\n },\n \"tags\": [\n \"elk\",\n \"web-status\"\n ],\n \"event\": {\n \"dataset\": \"http\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n },\n \"tcp\": {\n \"rtt\": {\n \"connect\": {\n \"us\": 407\n }\n }\n },\n \"http\": {\n \"rtt\": {\n \"total\": {\n \"us\": 1313\n },\n \"write_request\": {\n \"us\": 418\n },\n \"response_header\": {\n \"us\": 585\n },\n \"validate\": {\n \"us\": 663\n },\n \"content\": {\n \"us\": 77\n }\n },\n \"response\": {\n \"mime_type\": \"application/json\",\n \"headers\": {\n \"Content-Type\": \"application/json;charset=utf-8\",\n \"Content-Length\": \"403\",\n \"Www-Authenticate\": [\n \"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\",\n \"ApiKey\"\n ]\n },\n \"status_code\": 401,\n \"body\": {\n \"bytes\": 403,\n \"content\": \"{\\\"error\\\":{\\\"root_cause\\\":[{\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication credentials for REST request [/]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":[\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\",\\\"ApiKey\\\"]}}],\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication credentials for REST request [/]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":[\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\",\\\"ApiKey\\\"]}},\\\"status\\\":401}\",\n \"hash\": \"8cec75c315923dcacb5bc0be62c774dfb0411748ca96c747b5a18b915e3b8eec\"\n }\n }\n },\n \"monitor\": {\n \"status\": \"down\",\n \"duration\": {\n \"us\": 1349\n },\n \"check_group\": \"64126d81-86e0-11ed-b535-080027a43a3b\",\n \"ip\": \"192.168.1.139\",\n \"timespan\": {\n \"gte\": \"2022-12-28T18:49:47.807Z\",\n \"lt\": \"2022-12-28T18:49:52.807Z\"\n },\n \"name\": \"web-status check\",\n \"type\": \"http\",\n \"id\": \"web-status-8e8a549c8caee10b\"\n },\n \"summary\": {\n \"up\": 0,\n \"down\": 1\n }\n}","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-12-28T18:59:32.880Z","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":210},"message":"Publish event: {\n \"@timestamp\": \"2022-12-28T18:59:32.876Z\",\n \"@metadata\": {\n \"beat\": \"heartbeat\",\n \"type\": \"_doc\",\n \"version\": \"8.5.3\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n },\n \"agent\": {\n \"name\": \"heartbeat\",\n \"type\": \"heartbeat\",\n \"version\": \"8.5.3\",\n \"ephemeral_id\": \"49bc5eb8-1f29-4bca-9099-690ed7e14151\",\n \"id\": \"ee0b6046-e1ef-4b8b-adb4-7d397569c3e6\"\n },\n \"state\": {\n \"checks\": 1,\n \"flap_history\": [],\n \"down\": 1,\n \"ends\": {\n \"flap_history\": null,\n \"id\": \"web-status-default-1855a1a8e07-8f89\",\n \"checks\": 3,\n \"up\": 3,\n \"down\": 0,\n \"started_at\": \"2022-12-28T18:59:27.879251262Z\",\n \"duration_ms\": 4999,\n \"status\": \"up\",\n \"ends\": null\n },\n \"id\": \"web-status-default-1855a1aa18f-8f8a\",\n \"started_at\": \"2022-12-28T18:59:32.879991213Z\",\n \"duration_ms\": 0,\n \"status\": \"down\",\n \"up\": 0\n },\n \"tcp\": {\n \"rtt\": {\n \"connect\": {\n \"us\": 139\n }\n }\n },\n \"url\": {\n \"port\": 9200,\n \"full\": \"http://192.168.1.139:9200\",\n \"scheme\": \"http\",\n \"domain\": \"192.168.1.139\"\n },\n \"error\": {\n \"message\": \"Bad HTTP status Unauthorized encountered\",\n \"stack_trace\": null,\n \"type\": \"io\",\n \"code\": \"BAD_HTTP_STATUS\"\n },\n \"event\": {\n \"dataset\": \"http\"\n },\n \"summary\": {\n \"up\": 0,\n \"down\": 1\n },\n \"http\": {\n \"response\": {\n \"mime_type\": \"application/json\",\n \"headers\": {\n \"Content-Length\": \"403\",\n \"Www-Authenticate\": [\n \"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\",\n \"ApiKey\"\n ],\n \"Content-Type\": \"application/json;charset=utf-8\"\n },\n \"status_code\": 401,\n \"body\": {\n \"bytes\": 403,\n \"content\": \"{\\\"error\\\":{\\\"root_cause\\\":[{\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication credentials for REST request [/]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":[\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\",\\\"ApiKey\\\"]}}],\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication credentials for REST request [/]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":[\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\",\\\"ApiKey\\\"]}},\\\"status\\\":401}\",\n \"hash\": \"8cec75c315923dcacb5bc0be62c774dfb0411748ca96c747b5a18b915e3b8eec\"\n }\n },\n \"rtt\": {\n \"write_request\": {\n \"us\": 41\n },\n \"response_header\": {\n \"us\": 2793\n },\n \"validate\": {\n \"us\": 2852\n },\n \"content\": {\n \"us\": 58\n },\n \"total\": {\n \"us\": 3291\n }\n }\n },\n \"monitor\": {\n \"ip\": \"192.168.1.139\",\n \"timespan\": {\n \"gte\": \"2022-12-28T18:59:32.879Z\",\n \"lt\": \"2022-12-28T18:59:37.879Z\"\n },\n \"type\": \"http\",\n \"id\": \"web-status-8e8a549c8caee10b\",\n \"name\": \"web-status check\",\n \"status\": \"down\",\n \"duration\": {\n \"us\": 3327\n },\n \"check_group\": \"c0ccec7f-86e1-11ed-b535-080027a43a3b\"\n },\n \"tags\": [\n \"elk\",\n \"web-status\"\n ],\n \"observer\": {\n \"hostname\": \"ub2204elk\",\n \"ip\": [\n \"192.168.1.139\",\n \"2600:6c40:0:7de:a00:27ff:fea4:3a3b\",\n \"fe80::a00:27ff:fea4:3a3b\"\n ],\n \"mac\": [\n \"08-00-27-A4-3A-3B\"\n ]\n }\n}","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-12-28T18:59:37.079Z","log.logger":"tcp","log.origin":{"file.name":"tcp/tcp.go","file.line":232},"message":"dial failed with: Could not connect to '8.8.8.8:22' with error: dial tcp 8.8.8.8:22: i/o timeout","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-12-28T18:59:37.079Z","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":210},"message":"Publish event: {\n \"@timestamp\": \"2022-12-28T18:59:21.078Z\",\n \"@metadata\": {\n \"beat\": \"heartbeat\",\n \"type\": \"_doc\",\n \"version\": \"8.5.3\"\n },\n \"monitor\": {\n \"check_group\": \"bcbf6aa1-86e1-11ed-b535-080027a43a3b\",\n \"ip\": \"8.8.8.8\",\n \"timespan\": {\n \"gte\": \"2022-12-28T18:59:37.079Z\",\n \"lt\": \"2022-12-28T18:59:47.079Z\"\n },\n \"type\": \"tcp\",\n \"id\": \"ssh-status-77dc20028512919a\",\n \"name\": \"ssh-status check\",\n \"status\": \"down\",\n \"duration\": {\n \"us\": 16001037\n }\n },\n \"summary\": {\n \"up\": 0,\n \"down\": 1\n },\n \"tags\": [\n \"elk\",\n \"ssh-status\"\n ],\n \"event\": {\n \"dataset\": \"tcp\"\n },\n \"agent\": {\n \"name\": \"heartbeat\",\n \"type\": \"heartbeat\",\n \"version\": \"8.5.3\",\n \"ephemeral_id\": \"49bc5eb8-1f29-4bca-9099-690ed7e14151\",\n \"id\": \"ee0b6046-e1ef-4b8b-adb4-7d397569c3e6\"\n },\n \"state\": {\n \"id\": \"ssh-status-default-1855a1ab1f7-47df\",\n \"duration_ms\": 0,\n \"checks\": 1,\n \"down\": 1,\n \"flap_history\": [],\n \"started_at\": \"2022-12-28T18:59:37.079401223Z\",\n \"status\": \"down\",\n \"up\": 0,\n \"ends\": {\n \"duration_ms\": 0,\n \"status\": \"up\",\n \"up\": 1,\n \"flap_history\": null,\n \"id\": \"ssh-status-default-1855a1ab159-47de\",\n \"started_at\": \"2022-12-28T18:59:36.921325173Z\",\n \"checks\": 1,\n \"down\": 0,\n \"ends\": null\n }\n },\n \"url\": {\n \"full\": \"tcp://8.8.8.8:22\",\n \"scheme\": \"tcp\",\n \"domain\": \"8.8.8.8\",\n \"port\": 22\n },\n \"error\": {\n \"message\": \"Could not connect to '8.8.8.8:22' with error: dial tcp 8.8.8.8:22: i/o timeout\",\n \"stack_trace\": null,\n \"type\": \"io\",\n \"code\": \"NET_COULD_NOT_CONNECT\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n },\n \"observer\": {\n \"ip\": [\n \"192.168.1.139\",\n \"2600:6c40:0:7de:a00:27ff:fea4:3a3b\",\n \"fe80::a00:27ff:fea4:3a3b\"\n ],\n \"mac\": [\n \"08-00-27-A4-3A-3B\"\n ],\n \"hostname\": \"ub2204elk\"\n }\n}","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-12-28T18:59:37.085Z","log.logger":"tcp","log.origin":{"file.name":"tcp/tcp.go","file.line":232},"message":"dial failed with: Could not connect to '192.168.1.96:22' with error: dial tcp 192.168.1.96:22: connect: connection refused","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-12-28T18:59:37.085Z","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":210},"message":"Publish event: {\n \"@timestamp\": \"2022-12-28T18:59:37.085Z\",\n \"@metadata\": {\n \"beat\": \"heartbeat\",\n \"type\": \"_doc\",\n \"version\": \"8.5.3\"\n },\n \"summary\": {\n \"up\": 0,\n \"down\": 1\n },\n \"state\": {\n \"id\": \"ssh-status-default-1855a1ab1f7-47df\",\n \"duration_ms\": 6,\n \"checks\": 2,\n \"up\": 0,\n \"down\": 2,\n \"started_at\": \"2022-12-28T18:59:37.079401223Z\",\n \"status\": \"down\",\n \"flap_history\": [],\n \"ends\": null\n },\n \"tags\": [\n \"elk\",\n \"ssh-status\"\n ],\n \"event\": {\n \"dataset\": \"tcp\"\n },\n \"agent\": {\n \"name\": \"heartbeat\",\n \"type\": \"heartbeat\",\n \"version\": \"8.5.3\",\n \"ephemeral_id\": \"49bc5eb8-1f29-4bca-9099-690ed7e14151\",\n \"id\": \"ee0b6046-e1ef-4b8b-adb4-7d397569c3e6\"\n },\n \"url\": {\n \"scheme\": \"tcp\",\n \"domain\": \"192.168.1.96\",\n \"port\": 22,\n \"full\": \"tcp://192.168.1.96:22\"\n },\n \"error\": {\n \"message\": \"Could not connect to '192.168.1.96:22' with error: dial tcp 192.168.1.96:22: connect: connection refused\",\n \"stack_trace\": null,\n \"type\": \"io\",\n \"code\": \"NET_COULD_NOT_CONNECT\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n },\n \"observer\": {\n \"hostname\": \"ub2204elk\",\n \"ip\": [\n \"192.168.1.139\",\n \"2600:6c40:0:7de:a00:27ff:fea4:3a3b\",\n \"fe80::a00:27ff:fea4:3a3b\"\n ],\n \"mac\": [\n \"08-00-27-A4-3A-3B\"\n ]\n },\n \"monitor\": {\n \"timespan\": {\n \"gte\": \"2022-12-28T18:59:37.085Z\",\n \"lt\": \"2022-12-28T18:59:47.085Z\"\n },\n \"name\": \"ssh-status check\",\n \"type\": \"tcp\",\n \"id\": \"ssh-status-41495dff27be7473\",\n \"status\": \"down\",\n \"duration\": {\n \"us\": 267\n },\n \"check_group\": \"c05404f8-86e1-11ed-b535-080027a43a3b\",\n \"ip\": \"192.168.1.96\"\n }\n}","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-12-28T18:59:37.878Z","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":210},"message":"Publish event: {\n \"@timestamp\": \"2022-12-28T18:59:37.877Z\",\n \"@metadata\": {\n \"beat\": \"heartbeat\",\n \"type\": \"_doc\",\n \"version\": \"8.5.3\"\n },\n \"summary\": {\n \"up\": 0,\n \"down\": 1\n },\n \"http\": {\n \"response\": {\n \"mime_type\": \"application/json\",\n \"headers\": {\n \"Content-Length\": \"403\",\n \"Www-Authenticate\": [\n \"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\",\n \"ApiKey\"\n ],\n \"Content-Type\": \"application/json;charset=utf-8\"\n },\n \"status_code\": 401,\n \"body\": {\n \"hash\": \"8cec75c315923dcacb5bc0be62c774dfb0411748ca96c747b5a18b915e3b8eec\",\n \"bytes\": 403,\n \"content\": \"{\\\"error\\\":{\\\"root_cause\\\":[{\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication credentials for REST request [/]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":[\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\",\\\"ApiKey\\\"]}}],\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication credentials for REST request [/]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":[\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\",\\\"ApiKey\\\"]}},\\\"status\\\":401}\"\n }\n },\n \"rtt\": {\n \"total\": {\n \"us\": 1101\n },\n \"write_request\": {\n \"us\": 21\n },\n \"response_header\": {\n \"us\": 703\n },\n \"validate\": {\n \"us\": 763\n },\n \"content\": {\n \"us\": 60\n }\n }\n },\n \"tags\": [\n \"elk\",\n \"web-status\"\n ],\n \"agent\": {\n \"version\": \"8.5.3\",\n \"ephemeral_id\": \"49bc5eb8-1f29-4bca-9099-690ed7e14151\",\n \"id\": \"ee0b6046-e1ef-4b8b-adb4-7d397569c3e6\",\n \"name\": \"heartbeat\",\n \"type\": \"heartbeat\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n },\n \"event\": {\n \"dataset\": \"http\"\n },\n \"observer\": {\n \"hostname\": \"ub2204elk\",\n \"ip\": [\n \"192.168.1.139\",\n \"2600:6c40:0:7de:a00:27ff:fea4:3a3b\",\n \"fe80::a00:27ff:fea4:3a3b\"\n ],\n \"mac\": [\n \"08-00-27-A4-3A-3B\"\n ]\n },\n \"url\": {\n \"full\": \"http://192.168.1.139:9200\",\n \"scheme\": \"http\",\n \"domain\": \"192.168.1.139\",\n \"port\": 9200\n },\n \"error\": {\n \"stack_trace\": null,\n \"type\": \"io\",\n \"code\": \"BAD_HTTP_STATUS\",\n \"message\": \"Bad HTTP status Unauthorized encountered\"\n },\n \"state\": {\n \"status\": \"down\",\n \"up\": 0,\n \"down\": 1,\n \"ends\": {\n \"status\": \"up\",\n \"checks\": 1,\n \"up\": 1,\n \"started_at\": \"2022-12-28T18:59:37.583319766Z\",\n \"duration_ms\": 0,\n \"down\": 0,\n \"flap_history\": null,\n \"ends\": null,\n \"id\": \"web-status-default-1855a1ab3ef-8f8b\"\n },\n \"id\": \"web-status-default-1855a1ab516-8f8c\",\n \"started_at\": \"2022-12-28T18:59:37.878799155Z\",\n \"duration_ms\": 0,\n \"checks\": 1,\n \"flap_history\": []\n },\n \"tcp\": {\n \"rtt\": {\n \"connect\": {\n \"us\": 48\n }\n }\n },\n \"monitor\": {\n \"timespan\": {\n \"gte\": \"2022-12-28T18:59:37.878Z\",\n \"lt\": \"2022-12-28T18:59:42.878Z\"\n },\n \"type\": \"http\",\n \"id\": \"web-status-8e8a549c8caee10b\",\n \"name\": \"web-status check\",\n \"status\": \"down\",\n \"duration\": {\n \"us\": 1134\n },\n \"check_group\": \"c3c8489a-86e1-11ed-b535-080027a43a3b\",\n \"ip\": \"192.168.1.139\"\n }\n}","service.name":"heartbeat","ecs.version":"1.6.0"}
