Hi All,
I am new here. We have configured filebeat to logstash via SSL in our test environment. In our production environment, we are planning for an architecture similar to below:
Filebeat > Secure Apache based reverse proxy > Logstash > ES > Kibana
We are planning to use version 7.3.x.
I have few queries here,
- When I read through few posts, I find communication through http based reverse proxy is not feasible between filebeat and logstash. Only SOCKS5 proxy is allowed. Is this same for 7.3.x as well?
- Apart from SSL, does 7.3.x filebeat supports user authenication to logstash, similar to elasticsearch?
Note - We are not using X-Pack as of now.
Thanks
Jai.
Update to above post -
I have apache 2.4 reverse proxy between Filebeat and logstash. Disabled SSL now. I get below error in filebeat log
| 2019-09-18T10:44:52.287+0530 |
INFO |
pipeline/output.go:95 |
Connecting to backoff(async(tcp://XXX:80)) |
| 2019-09-18T10:44:52.582+0530 |
INFO |
pipeline/output.go:105 |
Connection to backoff(async(tcp://XXX:80)) established |
| 2019-09-18T10:44:52.933+0530 |
ERROR |
logstash/async.go:256 |
Failed to publish events caused by: lumberjack protocol error |
| 2019-09-18T10:44:52.938+0530 |
ERROR |
logstash/async.go:256 |
Failed to publish events caused by: client is not connected |
| 2019-09-18T10:44:54.136+0530 |
ERROR |
pipeline/output.go:121 |
Failed to publish events: client is not connected |