Filebeat tls: oversized record received with length 20527

Elastic Stack Beats
1

Hi

I'm trying to use filebeat to push logs from centos 7 to AWS ElasticSearch service. AWS forces me to use https:
hosts: ["https://search-.....-west-1.es.amazonaws.com:80/"]
filebeat fails with:
2016-08-30T12:43:28Z INFO Connecting error publishing events (retrying): Head https://search-......-west-1.es.amazonaws.com:80/: tls: oversized record received with length 20527

Any ideas?

Best

Mikolaj

2

It seems like AWS has some limits on the size of the requests: http://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-limits.html As an alternative there is our own cloud offering :wink: https://www.elastic.co/cloud

3

This is really weird. But I've no idea about AWS. Beats send a HEAD request on startup to check remote is actually available. The request does not contain any payload, as well as the response. Server should respond with 200 OK. only.

Is the port number 80 really correct? I'd assume port 80 to be unencrypted. For https there might be another port to use (check AWS docs)?

4

It was misconfiguration issue. I've set port to 443 and protocol: "https" and it's working correctly.

5

This topic was automatically closed after 21 days. New replies are no longer allowed.