Filebeat: Exiting: couldn't connect to any of the configured Elasticsearch hosts

Elastic Stack Beats
1

Running Windows 10 the Elastic and Kibana as .bat work fine but configuring beats from .zip download fails for me. I run all on the same machine and only changed the .yml file with this guide:

Even after a reset to default values I get the same error thats below. Is there something wrong with my machine?

While trying to run: .\Filebeat.exe setup -e

Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at http://127.0.0.1:9200: Get "http://127.0.0.1:9200": EOF]

elasticsearch.yml and kibana.yml are at default
here is my config file for Filebeat:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]

  username: "elastic"
  password: "my password"
  
  filebeat.inputs:
# filestream is an input for collecting log messages from files.
- type: filestream

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - C:\Users\derkau\Downloads\filebeatlog\\*.log

If any information is missing please let me know.

2

Hi @RomanKau which version of Elasticsearch, Kibana and Filebeat are you running?

Based on the links you posted and your config I'm assuming it's 8.0 and you're running everything locally.

On 8.0 TLS is enabled by default, so you need to set the ca_trusted_fingerprint on your output configuration as well as enable SSL:

output.elasticsearch:
  hosts: ["https://myEShost:9200"]
  username: "filebeat_internal"
  password: "YOUR_PASSWORD" 
  ssl:
    enabled: true
    ca_trusted_fingerprint: "b9a10bbe64ee9826abeda6546fc988c8bf798b41957c33d05db736716513dc9c"

When you start Elasticsearch for the first time it will log the value for ca_trusted_fingerprint.

If the auto-configuration process has already completed, you can follow those steps to get the CA fingerprint

2 Likes
3

Hey @TiagoQueiroz thanks for your quick reply. Yes I am running on 8.0 and locally.

now my filebeat config looks like this in output.elasticsearch: like you suggested:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]
  username: "elastic"
  password: "my password" 
  ssl:
    enabled: true 
    ca_trusted_fingerprint: "23aaa4eb19d2c1b2626a375a58b5225dd8df0cfcf69652af7634311dc6802261"

and I still get the same error message after trying .\Filebeat.exe setup -e

Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at http://localhost:9200: Get "http://localhost:9200": EOF]

is there a specific reason why filebeat cant communicate with my elasticsearch?

Thank you for your help.

4

Did you try setting the protocol to HTTPS?:

hosts: ["https://localhost:9200"]

It looks like Filebeat still trying to communicate over normal HTTP

2 Likes
5

Thanks for your quick replay again @TiagoQueiroz.
The communication between filebeat and elastic/kibana is working now!

I am trying now to get logfiles through to Kibana. If I'm running into any problem can I write in this thread again?

Thank you for your help I really appreciate it.

6

No problem! I'm happy it's all working now!

If you run into some new issues, please create a new thread, this helps keeping the threads organised and easy to find.

1 Like
7

I get the same problem but I resovled the problem with your answer
Thank you bro

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.