Filebeat setup fails to authenticate against Kibana

Hello!

I am setting up a PoC for ECK.

Kibana is exposed as a Kubernetes Ingress (nginx-controller) on port 80, and I can successfully access via web browser (using the credentials elastic and the password dynamically created).

kibana-ingress.yml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: kibana
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
 rules:
 - host: kibana.mydomain.something
   http:
     paths:
     - path: /
       backend:
         serviceName: elasticsearch-sample-kb-http
         servicePort: 5601

However when I execute filebeat setup -e on a client (with a filebeat.yml setup with the relevant authentication and endpoint listening on port 80), it fails when attempting to authenticate against Kibana (but does not fail when authenticating against Elastic):

2021-03-19T10:41:12.121Z	INFO	kibana/client.go:119	Kibana url: http://kibana.elastic-mydomain.something:80
2021-03-19T10:41:12.142Z	ERROR	instance/beat.go:971	Exiting: 1 error: error loading index pattern: parsing kibana respo </html>nter>nginx/1.17.8</center>o Large</h1></center>d>. Response: <html>
Exiting: 1 error: error loading index pattern: parsing kibana response: invalid character '<' looking for beginning of value. Respo </html>nter>nginx/1.17.8</center>o Large</h1></center>d>

It looks like the Kubernetes Ingress needs some tweaking? Possibly filebeat is not expecting HTML...

If anyone has any idea or tip that would be appreciated,
Thanks!

Hi!

It looks like it fails to parse nginx's response? Does Filebeat actually sends the request to Kibana? What are your Kibana host settings in Filebeat's documentation?