KK23
(KK)
April 12, 2019, 5:02am
1
Getting below errors in FileBeat after starting filebeat
ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(http://localhost:9200 )): Get http://localhost:9200 : EOF
Filebeat config file has this
output.elasticsearch:
Array of hosts to connect to.
hosts: ["localhost:9200"]
I also tried https but no luck
curl -v -k -XGET 'https://localhost:9200/filebeat-*/_search?pretty ' -u username:password works
and returns values
I have setup kibana and that is fine
Only Filebeat set up is causing so much issues, it looks straight forward to set up but its not working
Appreciate some help from someone please as i would really like this to run and seems to be the final blocker in having an EFK stack up and running.
Thanks,
Karthik
Hi @KK23 ,
Could you please help me to understand your environment ?
On which platform you are working?
Are you running elasticsearch on same node ?
is elasticsearch service in running state ?
Could you please share the elasticsearch.yml and filebeat.yml file here so that i can identify the issue??
Br,
Harsh Bajaj
Based on the curl command that works it looks like you need to configure Filebeat to use https and also configure a username and password. Have you tried this? If so can you show your config? Please make sure you format it properly.
KK23
(KK)
April 12, 2019, 6:59am
4
yep i tried this as well in filebeat.yml
protocol: "https"
username: abc
password: abc
username and password details just dummy ones listed above
but this method also not working
How did you specify the host
when you specified protocol
? Did you follow one of these examples ?
KK23
(KK)
April 12, 2019, 7:42am
6
yep i tried everything in that page before as well so its a puzzle its not working:confused: not sure why though
KK23
(KK)
April 12, 2019, 7:43am
7
hello,
this is a test environment
filebeat.yml has this
output.elasticsearch:
Array of hosts to connect to.
hosts: ["localhost:9200"]
protocol: "https"
username: abc
password: abc
Can you show the exact configuration you tried using username and password?
I see that you run curl with -k flag. Can you enable debug logging and check if Filebeat has any problem with the certificate?
Maybe try setting verification_mode in your config?
KK23
(KK)
April 12, 2019, 7:53am
10
seems like a limit of characters that can be posted i cant post the full config file details
KK23
(KK)
April 12, 2019, 7:58am
11
Is it possible to share your working filebeat config without username and password but the rest of the details which can serve as a reference.
thanks,
KK
KK23
(KK)
April 12, 2019, 8:21am
12
i get Get http://localhost:9200 : EOF in the file beat log i am not using https and also i am now using filebeat reference yml so i was expecting it to work
KK23
(KK)
April 12, 2019, 8:38am
13
Ok its working your answer helped me but now i have a different error to figure out now
Exiting: 1 error: Error checking if xpack is available: 500 Internal Server Error: {"error":{"root_cause":[{"type":"security_exception","reason":"Unexpected exception indices:admin/get"}],"type":"security_exception","reason":"Unexpected exception indices:admin/get"},"status":500}
system
(system)
Closed
May 10, 2019, 8:38am
14
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.