Filebeat setup fails to authenticate against Kibana

Elastic Stack Beats
1

Hello!

I am setting up a PoC for ECK.

Kibana is exposed as a Kubernetes Ingress (nginx-controller) on port 80, and I can successfully access via web browser (using the credentials elastic and the password dynamically created).

kibana-ingress.yml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: kibana
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
 rules:
 - host: kibana.mydomain.something
   http:
     paths:
     - path: /
       backend:
         serviceName: elasticsearch-sample-kb-http
         servicePort: 5601

However when I execute filebeat setup -e on a client (with a filebeat.yml setup with the relevant authentication and endpoint listening on port 80), it fails when attempting to authenticate against Kibana (but does not fail when authenticating against Elastic):

2021-03-19T10:41:12.121Z	INFO	kibana/client.go:119	Kibana url: http://kibana.elastic-mydomain.something:80
2021-03-19T10:41:12.142Z	ERROR	instance/beat.go:971	Exiting: 1 error: error loading index pattern: parsing kibana respo </html>nter>nginx/1.17.8</center>o Large</h1></center>d>. Response: <html>
Exiting: 1 error: error loading index pattern: parsing kibana response: invalid character '<' looking for beginning of value. Respo </html>nter>nginx/1.17.8</center>o Large</h1></center>d>

It looks like the Kubernetes Ingress needs some tweaking? Possibly filebeat is not expecting HTML...

If anyone has any idea or tip that would be appreciated,
Thanks!

2

Hi!

It looks like it fails to parse nginx's response? Does Filebeat actually sends the request to Kibana? What are your Kibana host settings in Filebeat's documentation?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.