Filebeat configuration file


(Chi Hong Chen) #1

Kibana has used nginx as a reverse proxy.
kibana version 6.2
filebeat version 6.3

filebeat.config:
  inputs:
    enabled: true
  modules:
    enabled: true

filebeat.inputs:
  enabled: true

filebeat.modules:
  - module: system
    syslog:
      enabled: true
      var.path: ["/var/log/syslog*"]
      var.convert_timezone: true
      input:
        exclude_files: ['.gz$']
    auth:
      enabled: true
      var.path: ["/var/log/auth*"]
      var.convert_timezone: true
      input:
        exclude_files: ['.gz$']

output.elasticsearch:
  enabled: false

output.logstash:
  enabled: true
  hosts: ["192.168.XX.XX:10514"]
  ssl.enabled: false

setup.kibana:
  enabled: true
  host: "192.168.XX.XX:8080"
  username: "XXX"
  password: "XXX"
  ssl.enabled: false

#setup.dashboards.enabled: true

When the setup.dashboards.enabled: true annotation is removed, the following error occurs when running docker

2018-07-11T06:51:24.926Z        ERROR   instance/beat.go:691    Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: Error creating Kibana client: fail to get the Kibana version: HTTP GET request to /api/status fails: parsing kibana response: invalid character '<' looking for beginning of ./html>nter>nginx/1.13.12</center>center>d>
Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: Error creating Kibana client: fail to get the Kibana version: HT ./html>nter>nginx/1.13.12</center>center>d> kibana response: invalid character '<' looking for beginning of value. Response: <html>

(Noémi Ványi) #2

Your Filebeat configuration is correct. However, your reverse proxy is configured incorrectly. Filebeat should be getting a JSON response from Kibana which contains its version info. But in your case the response is some HTML returned by NGINX. Are you sure you configured it correctly?


(Chi Hong Chen) #3

But I execute curl and display information normally.

curl http://192.168.XX.XX:8080/api/status

(Noémi Ványi) #4

Do you execute this command inside the Docker container where Filebeat fails to fetch the data?


(Chi Hong Chen) #5

Can be executed normally.


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.