Filebeat Xpack

Hello,

I am a newbie to ELK. I configured Elasticsearch/Kibana/FileBeat, config was working till xpack was installed. xpack authentication works fine for ElasticSearch/Kibana but filebeat has issues on restart:

2018-05-22T13:32:31.988-0400 ERROR elasticsearch/elasticsearch.go:165 Error connecting to Elasticsearch at :9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401}
2018-05-22T13:32:31.991-0400 INFO [monitoring] log/log.go:132 Total non-zero metrics {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":10,"time":16},"total":{"ticks":30,"time":38,"value":30},"user":{"ticks":20,"time":22}},"info":{"ephemeral_id":"e4c3e081-0a84-4105-98ba-3f8cdc9f4fc4","uptime":{"ms":23}},"memstats":{"gc_next":4194304,"memory_alloc":2987648,"memory_total":2987648,"rss":12853248}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"output":{"type":"elasticsearch"},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"cpu":{"cores":4},"load":{"1":2.75,"15":1.83,"5":1.69,"norm":{"1":0.6875,"15":0.4575,"5":0.4225}}}}}}
2018-05-22T13:32:31.991-0400 INFO [monitoring] log/log.go:133 Uptime: 26.700097ms
2018-05-22T13:32:31.991-0400 INFO [monitoring] log/log.go:110 Stopping metrics logging.
2018-05-22T13:32:31.991-0400 ERROR instance/beat.go:667 Exiting: Error importing Kibana dashboards: fail to create the Elasticsearch loader: Error creating Elasticsearch client: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch http://:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401}]
Exiting: Error importing Kibana dashboards: fail to create the Elasticsearch loader: Error creating Elasticsearch client: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch http://:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401}]

Can anyone help with this?

It doesn't look like you configured any authentication credentials in your Filebeat config.
We have docs on how to configure Beats to work with X-Pack:

Tim,

Following instructions i was able to bring up the server and ingest data from remote to ES.

Thanks,
Surendra.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.