Filebeat setup: error loading index pattern: returned 413 to import file: invalid character ‘<’ looking for beginning of value

Elastic Stack Beats
1

Hi,

I try to run a filebeat on a server. Elastic and Kibana are installed on another server and are pushed on 443 port via a Nginx reverse proxy. Kibana GUI is working on the IP I set up (https with self-generated certificate).

When I run # sudo filebeat setup I get this error:

Exiting: 1 error: error loading index pattern: returned 413 to import file: invalid character '<' looking for beginning of value. Response: <html>
<head><title>413 Request Entity Too Large</title></head>
<body bgcolor="white">
<center><h1>413 Request Entity Too Large</h1></center>
<hr><center>nginx/1.14.1</center>
</body>
</html>

Filebeat.yml On the filebeat server (only the uncommented lines)

# ============================== Filebeat inputs ===============================

filebeat.inputs:

- type: filestream

  id: my-filestream-id

  enabled: false

  paths:

    - /var/log/*.log

# ============================== Filebeat modules ==============================

filebeat.config.modules:

  path: ${path.config}/modules.d/*.yml

  reload.enabled: false

# ================================== Outputs ===================================

# ---------------------------- Elasticsearch Output ----------------------------

output.elasticsearch:

  hosts: ["<IP-ES-KIBANA>:443/es/"]

  ssl.certificate: "/ca/ca.crt"

  ssl.key: "/ca/ca.key"

  ssl.verification_mode: "none"

# ================================= Processors =================================

processors:

  - add_host_metadata:

      when.not.contains.tags: forwarded

  - add_cloud_metadata: ~

  - add_docker_metadata: ~

  - add_kubernetes_metadata: ~

Nginx conf on the Elastic/Kibana server

server {

  listen 443 ssl; 

  server_name <IP-ES-KIBANA>;

 

  ssl on;

  ssl_certificate /ca/ca.crt;

  ssl_certificate_key /ca/ca.key;

 

  location /kibana/ {

    proxy_pass http://localhost:5601/;

      }

 

  location /es/ {

    proxy_pass http://localhost:9200/;

    #proxy_read_timeout 90;

  }

}

Version filebeat: 8.2.2 / Version Elastic search: 8.2.2
Can someone help to figure it out what it is?

Thanks in advance …

2

I solve this issue by adding :
client_max_body_size 100M;
in the nginx.conf file

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.