Filebeat config.hosts using url

I have a elasticSearch deployed on url "". I can curl it and get result like following

[root@A04-R08-I198-70-1WLFTP2 conf]# curl -v
* About to connect() to port 80 (#0)
< content-type: application/json; charset=UTF-8
< content-length: 523
< Connection: close
  "name" : "",
  "cluster_name" : "yufa_en_tmp_test",
  "cluster_uuid" : "aMbdZAfSQKyAqLN6RlosHA",
  "version" : {
    "number" : "6.8.0",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "65b6179",
    "build_date" : "2019-05-15T20:06:13.172855Z",
    "build_snapshot" : false,
    "lucene_version" : "7.7.0",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  "tagline" : "You Know, for Search"
* Closing connection 0

But when I use filebeat, I got error like this:

[root@A04-R08-I198-70-1WLFTP2 conf]# filebeat test output -c /export/xxx/conf/filebeat.yml -e           
2019-09-10T21:29:14.066+0800    INFO    instance/beat.go:606    Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2019-09-10T21:29:14.066+0800    INFO    instance/beat.go:614    Beat ID: 9ddafba8-70c5-4961-8a20-c19e60d4c1452019-09-10T21:29:14.066+0800    INFO    [index-management]      idxmgmt/std.go:178      Set output.elasticsearch.index to 'filebeat-7.3.1' as ILM is enabled.
2019-09-10T21:29:14.067+0800    INFO    elasticsearch/client.go:170     Elasticsearch url:
elasticsearch:  parse url... OK
    parse host... OK
    dns lookup... OK
    dial up... OK
  TLS... WARN secure connection disabled
  talk to server... ERROR 503 Service Unavailable: <html><body><h1>503 Service Unavailable</h1>
No server is available to handle this request.

I think problem is about http-protocol. Can someone help me to finger it out?

Can we see your elasticsearch config? Might be an issue with the node discovery settings or some such.

Thank you, but I work around.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.