I am setting up a PoC for ECK.
Kibana is exposed as a Kubernetes Ingress (nginx-controller) on port 80, and I can successfully access via web browser (using the credentials
elastic and the password dynamically created).
apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: kibana annotations: kubernetes.io/ingress.class: nginx spec: rules: - host: kibana.mydomain.something http: paths: - path: / backend: serviceName: elasticsearch-sample-kb-http servicePort: 5601
However when I execute
filebeat setup -e on a client (with a filebeat.yml setup with the relevant authentication and endpoint listening on port 80), it fails when attempting to authenticate against Kibana (but does not fail when authenticating against Elastic):
2021-03-19T10:41:12.121Z INFO kibana/client.go:119 Kibana url: http://kibana.elastic-mydomain.something:80 2021-03-19T10:41:12.142Z ERROR instance/beat.go:971 Exiting: 1 error: error loading index pattern: parsing kibana respo </html>nter>nginx/1.17.8</center>o Large</h1></center>d>. Response: <html> Exiting: 1 error: error loading index pattern: parsing kibana response: invalid character '<' looking for beginning of value. Respo </html>nter>nginx/1.17.8</center>o Large</h1></center>d>
It looks like the Kubernetes Ingress needs some tweaking? Possibly filebeat is not expecting HTML...
If anyone has any idea or tip that would be appreciated,