Filebeat gives an error when it outputs to elasticsearch

Elastic Stack Beats
,
1

My elastic cluster version is 8.6.0 and filebeat version is 8.6.0

The log has been successfully read, but there will be some errors in the log output.

Failed to connect to backoff (elasticsearch (http://192.168.3.74:30920)) : Connection marked as failed because the onConnect callback failed: error loading template: error creating template instance: key not found

Running with k8s, the elastic cluster runs normally
this is daemonset yml file:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: $${CI_PROJECT_NAME}-daemonset
  namespace: $${CI_PROJECT_NAME}
  labels:
    run: $${CI_PROJECT_NAME}
spec:
  selector:
    matchLabels:
      run: $${CI_PROJECT_NAME}
  template:
    metadata:
      labels:
        run: $${CI_PROJECT_NAME}
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: $${CLUSTER_LABLE}
                    operator: Exists
      serviceAccountName: filebeat
      terminationGracePeriodSeconds: 30
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      containers:
      - name: $${CI_PROJECT_NAME}
        image: $${VERSION_IMAGE}
        env:
        - name: ELASTICSEARCH_HOST
          value: "192.168.3.74"
        - name: ELASTICSEARCH_PORT
          value: "30920"
        #- name: ELASTICSEARCH_USERNAME
          #value: elastic
        #- name: ELASTICSEARCH_PASSWORD
          #value: changeme
        - name: ELASTIC_CLOUD_ID
          value:
        - name: ELASTIC_CLOUD_AUTH
          value:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        securityContext:
          runAsUser: 0
          # If using Red Hat OpenShift uncomment this:
          #privileged: true
        resources:
          requests:
            cpu: 200m
            memory: 512Mi
          limits:
            cpu: 500m
            memory: 2048Mi
        volumeMounts:
        - name: filebeat-config-volume
          mountPath: /usr/share/filebeat/filebeat.yml
          subPath: filebeat.yml
        #- name: data
          #mountPath: /usr/share/filebeat/data
        - name: containers
          mountPath: /var/log/containers/
        - name: pods
          mountPath: /var/log/pods/
        - name: varlibcontainers
          mountPath: /var/lib/docker/containers/
          readOnly: true
      volumes:
      - name: filebeat-config-volume
        configMap:
          name: $${CI_PROJECT_NAME}-config
      - name: containers
        hostPath:
          path: /var/log/containers/
      - name: pods
        hostPath:
          path: /var/log/pods/
      - name: varlibcontainers
        hostPath:
          path: /var/lib/docker/containers/
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: $${CI_PROJECT_NAME}-config
  namespace: $${CI_PROJECT_NAME}
  labels:
    run: $${CI_PROJECT_NAME}
data:
  filebeat.yml: |-
    filebeat.inputs:
    - type: container
      paths:
        - /var/log/containers/*.log
      processors:
        - add_kubernetes_metadata:
            host: $${NODE_NAME}
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"

    # To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this:
    #filebeat.autodiscover:
    #  providers:
    #    - type: kubernetes
    #      node: ${NODE_NAME}
    #      hints.enabled: true
    #      hints.default_config:
    #        type: container
    #        paths:
    #          - /var/log/containers/*${data.kubernetes.container.id}.log

    processors:
      - add_cloud_metadata:
      - add_host_metadata:

    cloud.id: $${ELASTIC_CLOUD_ID}
    cloud.auth: $${ELASTIC_CLOUD_AUTH}
    
    setup.template.name: "%{[fields.log_type]}"
    setup.template.pattern: "%{[fields.log_type]}-*"


    output.elasticsearch:
      enabled: true
      hosts: ['$${ELASTICSEARCH_HOST:elasticsearch}:$${ELASTICSEARCH_PORT:9200}']
      index: "%{[fields.log_type]}-%{[agent.version]}-%{+yyyy.MM.dd}"
      #username: ${ELASTICSEARCH_USERNAME}
      #password: ${ELASTICSEARCH_PASSWORD}

RBAC authorization is set correctly

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.