Filebeat fails to send monitoring stats to Elasticsearch

I cannot seem to setup the xpack monitoring of Filebeats successfully.

Filebeats keeps logging error messages similar to:

2018-03-19T12:29:20.396-0700 ERROR pipeline/output.go:92 Failed to publish events: 500 Internal Server Error: {"took":9,"errors":true,"error":{"type":"export_exception","reason":"failed to add documents to export bulks","exceptions":[{"type":"export_exception","reason":"failed to add documents to export bulk [default_local]","exceptions":[{"type":"export_exception","reason":"failed to add document [org.elasticsearch.xpack.monitoring.action.MonitoringBulkDoc@35dd5055]","caused_by":{"type":"illegal_argument_exception","reason":"No resolver found for monitoring document"}}]}]}}

whenever it attempts to send the monitoring stats to Elasticsearch.

Any help resolving this error message?

My filebeat.yml x-pack settings:

#============================== Xpack Monitoring ===============================
# filebeat can export internal metrics to a central Elasticsearch monitoring
# cluster.  This requires xpack monitoring to be enabled in Elasticsearch.  The
# reporting is disabled by default.

# Set to true to enable the monitoring reporter.
xpack.monitoring.enabled: true

# Uncomment to send the metrics to Elasticsearch. Most settings from the
# Elasticsearch output are accepted here as well. Any setting that is not set is
# automatically inherited from the Elasticsearch output configuration, so if you
# have the Elasticsearch output configured, you can simply uncomment the
# following line.
xpack.monitoring.elasticsearch:
    hosts: ["kibana:9200"]

Which version of Filebeat are you using? Which version of Elasticsearch and Kibana?

Filebeat: 6.2.2

Apparently, 5.6.4 for Elasticsearch and Kibana rather than the 6+ that I thought. I'm guessing the error will go away upon upgrading then?

Yes, you need at least 6.2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.