FileBeat Connection error to elastic search

Elastic Stack Elasticsearch
1

Getting below errors in FileBeat after starting filebeat
ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(http://localhost:9200)): Get http://localhost:9200: EOF

Filebeat config file has this
output.elasticsearch:

Array of hosts to connect to.

hosts: ["localhost:9200"]

I also tried https but no luck

curl -v -k -XGET 'https://localhost:9200/filebeat-*/_search?pretty' -u username:password works
and returns values

I have setup kibana and that is fine
Only Filebeat set up is causing so much issues, it looks straight forward to set up but its not working

Appreciate some help from someone please as i would really like this to run and seems to be the final blocker in having an EFK stack up and running.

Thanks,
Karthik

2

Hi @KK23,

Could you please help me to understand your environment ?

On which platform you are working?
Are you running elasticsearch on same node ?
is elasticsearch service in running state ?

Could you please share the elasticsearch.yml and filebeat.yml file here so that i can identify the issue??

Br,
Harsh Bajaj

3

Based on the curl command that works it looks like you need to configure Filebeat to use https and also configure a username and password. Have you tried this? If so can you show your config? Please make sure you format it properly.

4

yep i tried this as well in filebeat.yml
protocol: "https"
username: abc
password: abc

username and password details just dummy ones listed above
but this method also not working

5

How did you specify the host when you specified protocol? Did you follow one of these examples?

6

yep i tried everything in that page before as well so its a puzzle its not working:confused: not sure why though

7

hello,
this is a test environment
filebeat.yml has this
output.elasticsearch:

Array of hosts to connect to.

hosts: ["localhost:9200"]
protocol: "https"
username: abc
password: abc

8

Can you show the exact configuration you tried using username and password?

9

I see that you run curl with -k flag. Can you enable debug logging and check if Filebeat has any problem with the certificate?

Maybe try setting verification_mode in your config?

10

seems like a limit of characters that can be posted i cant post the full config file details

11

Is it possible to share your working filebeat config without username and password but the rest of the details which can serve as a reference.

thanks,
KK

12

i get Get http://localhost:9200: EOF in the file beat log i am not using https and also i am now using filebeat reference yml so i was expecting it to work

13

Ok its working your answer helped me but now i have a different error to figure out now :grinning:

Exiting: 1 error: Error checking if xpack is available: 500 Internal Server Error: {"error":{"root_cause":[{"type":"security_exception","reason":"Unexpected exception indices:admin/get"}],"type":"security_exception","reason":"Unexpected exception indices:admin/get"},"status":500}