Filebeat configuration file

Elastic Stack Beats
1

Kibana has used nginx as a reverse proxy.
kibana version 6.2
filebeat version 6.3

filebeat.config:
  inputs:
    enabled: true
  modules:
    enabled: true

filebeat.inputs:
  enabled: true

filebeat.modules:
  - module: system
    syslog:
      enabled: true
      var.path: ["/var/log/syslog*"]
      var.convert_timezone: true
      input:
        exclude_files: ['.gz$']
    auth:
      enabled: true
      var.path: ["/var/log/auth*"]
      var.convert_timezone: true
      input:
        exclude_files: ['.gz$']

output.elasticsearch:
  enabled: false

output.logstash:
  enabled: true
  hosts: ["192.168.XX.XX:10514"]
  ssl.enabled: false

setup.kibana:
  enabled: true
  host: "192.168.XX.XX:8080"
  username: "XXX"
  password: "XXX"
  ssl.enabled: false

#setup.dashboards.enabled: true

When the setup.dashboards.enabled: true annotation is removed, the following error occurs when running docker

2018-07-11T06:51:24.926Z        ERROR   instance/beat.go:691    Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: Error creating Kibana client: fail to get the Kibana version: HTTP GET request to /api/status fails: parsing kibana response: invalid character '<' looking for beginning of ./html>nter>nginx/1.13.12</center>center>d>
Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: Error creating Kibana client: fail to get the Kibana version: HT ./html>nter>nginx/1.13.12</center>center>d> kibana response: invalid character '<' looking for beginning of value. Response: <html>
2

Your Filebeat configuration is correct. However, your reverse proxy is configured incorrectly. Filebeat should be getting a JSON response from Kibana which contains its version info. But in your case the response is some HTML returned by NGINX. Are you sure you configured it correctly?

3

But I execute curl and display information normally.

curl http://192.168.XX.XX:8080/api/status
4

Do you execute this command inside the Docker container where Filebeat fails to fetch the data?

5

Can be executed normally.