Filebeat fails to connect because template

Elastic Stack Beats
1

Hi elastic community,

I have a elasticsearch cluster running version "number": "7.1.1"

I have followed the instructions to install filebeat found here: https://www.elastic.co/docker-kubernetes-container-monitoring

^ the problem with these instructions is that it applies version 6.3.2 of filebeat, so it wasnt working.

I edited the yaml, and made it filebeat version 7.1.1, then applied it with kubectl delete -f <file> ; kubectl apply -f <file>

Now, filebeat is having this error:

2019-06-28T09:04:33.254Z	ERROR	pipeline/output.go:74	Failed to connect: Connection marked as failed because the onConnect callback failed: Error loading Elasticsearch template: could not load template. Elasticsearh returned: couldn't load template: couldn't load json.

Error: 400 Bad Request: err_400_bad_request.json

Response body: response_body.json

Template is: template.json

I have extracted the json files from the error message and attached them here:

err_400_bad_request.json: https://bin.privacytools.io/?3cbfd54af020b060#7cPwR9ixYklImqbWWg/lV1cJvpYUUkuY6BDMkFbF2Yw=

response_body.json: https://bin.privacytools.io/?183dfc854ed7f198#bZgZR49vL7Jaj6n+77mYMCYtinqQ1fPuHyExFTtLGhc=

template.json: https://bin.privacytools.io/?b71586ac8d2be1a7#D08XYpC15r3R02YPPT19BSl1ahfMP+e7aptAYB7CuGo=

What do I need to do to fix this?
My goal is to use filebeat on my kubernetes cluster, and see the data in kibana.

I have tried to delete the templates, but I am new to kibana and I am unsure if that helped or didnt.

2

i found the issue:

it was this config: output.elasticsearch.hosts: ["elasticsearch-hostname:9200"]

it needed to be this: output.elasticsearch.hosts: ["http://elasticsearch-hostname:9200"]

it was missing this: http:// on the hostname

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.