Filebeat and ingest node error


(Marcello A) #1

Hi All,
I installed the latest filebeat 5.4.0 on a CentOS 7 server and i tried to parse the auditd file with the specific module and i redirect the output to an elasticsearch 5.4.0 instance. I noticed an error fro filebeat related to the bulk operation and on elasticsearch i recived this exception:

 [2017-05-09T16:07:26,508][WARN ][r.suppressed             ] path: /_bulk, params: {}
java.lang.IllegalStateException: There are no ingest nodes in this cluster, unable to forward request to an ingest node.

Could you confirm if an ingest node it's required for this module?

Thanks,
Marcello


(Steffen Siering) #2

All parsing in filebeat modules is done via ingest node.


(Marcello A) #3

Thanks for the node it's working now.

Marcello


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.