Filebeat monitor via proxy_url

Elastic Stack Beats
1

Hi All,

filebeat version: 6.2.4

According to the filebeat-reference-yml you can set a proxy server to send the monitoring data to elasticsearch. I have setup the config like this.

xpack.monitoring:
  proxy_url: 'http://logstash.tb.ukmail.iss.local:31337'
  enabled: true
  elasticsearch:
    hosts: ["10.80.3.80:9200","10.80.3.81:9200","10.80.3.82:9200","10.80.3.83:9200","10.80.3.84:9200","10.80.3.85:9200"]
    username: elastic
    password: changeme

This however does not work. On a restart I see the monitoring ES hosts.

|2018-05-29T11:29:18.241+0200|INFO|instance/beat.go:475|Beat UUID: 2c7d2746-6d63-4e9a-b430-04447148d176|
|---|---|---|---|
|2018-05-29T11:29:18.241+0200|INFO|instance/beat.go:213|Setup Beat: filebeat; Version: 6.2.4|
|2018-05-29T11:29:18.242+0200|INFO|pipeline/module.go:76|Beat name: mx|
|2018-05-29T11:29:18.242+0200|INFO|elasticsearch/client.go:145|Elasticsearch url: http://10.80.3.80:9200|
|2018-05-29T11:29:18.242+0200|INFO|elasticsearch/client.go:145|Elasticsearch url: http://10.80.3.81:9200|
|2018-05-29T11:29:18.242+0200|INFO|elasticsearch/client.go:145|Elasticsearch url: http://10.80.3.82:9200|
|2018-05-29T11:29:18.243+0200|INFO|elasticsearch/client.go:145|Elasticsearch url: http://10.80.3.83:9200|
|2018-05-29T11:29:18.243+0200|INFO|elasticsearch/client.go:145|Elasticsearch url: http://10.80.3.84:9200|
|2018-05-29T11:29:18.243+0200|INFO|elasticsearch/client.go:145|Elasticsearch url: http://10.80.3.85:9200|
|2018-05-29T11:29:18.246+0200|INFO|instance/beat.go:301|filebeat start running.|

But then after the first monitoring data is collected I get the following error:

2018-05-29T11:30:18.247+0200 ERROR elasticsearch/elasticsearch.go:165 Monitoring could not connect to elasticsearch, failed with Get http://10.80.3.85:9200/_xpack?filter_path=features.monitoring.enabled: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)

It looks like the proxy_url setting is being ignored.

A wget to the monitoring hosts trough the proxy works just fine.

[root@mx1 ~]# export http_proxy=logstash.tb.ukmail.iss.local:31337
[root@mx1 ~]# wget http://10.80.3.80:9200/
--2018-05-29 11:24:58--  http://10.80.3.80:9200/
Resolving logstash.tb.ukmail.iss.local... 172.25.160.24
Connecting to logstash.tb.ukmail.iss.local|172.25.160.24|:31337... connected.
Proxy request sent, awaiting response... 200 OK
Length: 456 [application/json]
Saving to: “index.html”

100%[=======================================================================================================================================>] 456         --.-K/s   in 0s

2018-05-29 11:24:58 (44.7 MB/s) - “index.html” saved [456/456]

[root@mx1 ~]# more index.html
{
  "name" : "tb-clog-emon1.tb.iss.local",
  "cluster_name" : "clog-monitoring",
  "cluster_uuid" : "Ey27nHc_TZm6iDvs8WuIbg",
  "version" : {
    "number" : "6.2.4",
    "build_hash" : "ccec39f",
    "build_date" : "2018-04-12T20:37:28.497551Z",
    "build_snapshot" : false,
    "lucene_version" : "7.2.1",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

Anybody some pointers what to do next? Or is this a bug?

2

If you run the following command it work.

[root@mx1 ~]# export http_proxy=logstash.tb.ukmail.iss.local:31337
[root@mx1 ~]# /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat

So this seems like a bug in filebeat.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.