Filesetup is not working

lielar · February 1, 2021, 12:24am

I am currently in the Observability Fundamentals lab.

While running the command ./filebeat setup, it brings up the following error

Overwriting ILM policy is disabled. Set `setup.ilm.overwrite: true` for enabling.

Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards
Setting up ML using setup --machine-learning is going to be removed in 8.0.0. Please use the ML app instead.
See more: https://www.elastic.co/guide/en/machine-learning/current/index.html
Exiting: 2 errors: Error setting up ML for nginx_ecs: 10 errors: ; ; ; ; ; ; ; ; ; ; Error setting up ML for nginx_ecs: 10 errors: ; ; ; ; ; ; ; ; ;

I have left the modules.d/nginx.yml file unchanged.

A couple of people have sent messages without a solution since November 2020. Hoping someone can help!

warkolm · February 1, 2021, 12:40am

Is there more to the log file?

lielar · February 1, 2021, 1:29am

I thought that the ML component is not running. I got some warning from the cloud console that ML component is not running.

I enabled the Machine Learning module and rerun the command. Still no luck. Is there something I am missing here?

warkolm · February 1, 2021, 1:30am

Can you please share more of the 'fb log.

lielar · February 1, 2021, 1:33am

2021-02-01T01:25:06.013Z        INFO    [beat]  instance/beat.go:981    Beat info       {"system_info": {"beat": {"path": {"config": "/home/elastic/filebeat
-7.10.0-linux-x86_64", "data": "/home/elastic/filebeat-7.10.0-linux-x86_64/data", "home": "/home/elastic/filebeat-7.10.0-linux-x86_64", "logs": "/home/elast
ic/filebeat-7.10.0-linux-x86_64/logs"}, "type": "filebeat", "uuid": "68474046-424d-46a7-ab80-7b5dcdbb778f"}}}
2021-02-01T01:25:06.013Z        INFO    [beat]  instance/beat.go:990    Build info      {"system_info": {"build": {"commit": "1428d58cf2ed945441fb2ed03961ca
fa9e4ad3eb", "libbeat": "7.10.0", "time": "2020-11-09T19:57:04.000Z", "version": "7.10.0"}}}
2021-02-01T01:25:06.013Z        INFO    [beat]  instance/beat.go:993    Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":2,"v
ersion":"go1.14.7"}}}
2021-02-01T01:25:06.014Z        INFO    [beat]  instance/beat.go:997    Host info       {"system_info": {"host": {"architecture":"x86_64","boot_time":"2021-
01-31T23:44:28Z","containerized":false,"name":"ip-172-31-2-108","ip":["127.0.0.1/8","::1/128","172.31.2.108/20","fe80::ca:52ff:fe98:2bd0/64","172.18.0.1/25"
,"172.17.0.1/16"],"kernel_version":"4.4.0-1119-aws","mac":["02:ca:52:98:2b:d0","02:42:be:a2:a6:4b","02:42:d0:1f:b1:c2"],"os":{"family":"debian","platform":"
ubuntu","name":"Ubuntu","version":"16.04.6 LTS (Xenial Xerus)","major":16,"minor":4,"patch":6,"codename":"xenial"},"timezone":"UTC","timezone_offset_sec":0,
"id":"49a3bdeb77c346b28f71f8be96c3eeb2"}}}
2021-02-01T01:25:06.014Z        INFO    [beat]  instance/beat.go:1026   Process info    {"system_info": {"process": {"capabilities": {"inheritable":null,"pe
rmitted":null,"effective":null,"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","
net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","s
ys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","
wake
_alarm","block_suspend","audit_read"],"ambient":null}, "cwd": "/home/elastic/filebeat-7.10.0-linux-x86_64", "exe": "/home/elastic/filebeat-7.10.0-linux-x86_664/filebeat", "name": "filebeat", "pid": 10306, "ppid": 3108, "seccomp": {"mode":"disabled"}, "start_time": "2021-02-01T01:25:05.240Z"}}}
2021-02-01T01:25:06.014Z        INFO    instance/beat.go:299    Setup Beat: filebeat; Version: 7.10.0
2021-02-01T01:25:06.014Z        INFO    [index-management]      idxmgmt/std.go:184      Set output.elasticsearch.index to 'filebeat-7.10.0' as ILM is enabled.
2021-02-01T01:25:06.014Z        INFO    eslegclient/connection.go:99    elasticsearch url: https://a269c7a740a14685ba886ec44532006e.australia-southeast1.gcp.elastic-cloud.com:443
2021-02-01T01:25:06.015Z        INFO    [publisher]     pipeline/module.go:113  Beat name: ip-172-31-2-108
2021-02-01T01:25:06.015Z        INFO    eslegclient/connection.go:99    elasticsearch url: https://a269c7a740a14685ba886ec44532006e.australia-southeast1.gcp.elastic-cloud.com:443
2021-02-01T01:25:06.017Z        INFO    [add_cloud_metadata]    add_cloud_metadata/add_cloud_metadata.go:93     add_cloud_metadata: hosting provider type detected as aws, metadata={"account":{"id":"214514861431"},"availability_zone":"eu-central-1a","image":{"id":"ami-069d12620063ca30c"},"instance":{"id":"i-0081b0ba887447934"},"machine":{"type":"t2.medium"},"provider":"aws","region":"eu-central-1"}
2021-02-01T01:25:07.389Z        INFO    [esclientleg]   eslegclient/connection.go:314   Attempting to connect to Elasticsearch version 7.10.2
2021-02-01T01:25:07.684Z        INFO    [index-management]      idxmgmt/std.go:261      Auto ILM enable success.
2021-02-01T01:25:07.983Z        INFO    [index-management.ilm]  ilm/std.go:139  do not generate ilm policy: exists=true, overwrite=false
2021-02-01T01:25:07.983Z        INFO    [index-management]      idxmgmt/std.go:274      ILM policy successfully loaded.
2021-02-01T01:25:07.983Z        INFO    [index-management]      idxmgmt/std.go:407      Set setup.template.name to '{filebeat-7.10.0 {now/d}-000001}' as ILM is enabled.
2021-02-01T01:25:07.983Z        INFO    [index-management]      idxmgmt/std.go:412      Set setup.template.pattern to 'filebeat-7.10.0-*' as ILM is enabled.
2021-02-01T01:25:07.983Z        INFO    [index-management]      idxmgmt/std.go:446      Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.10.0 {now/d}-000001} as ILM is enabled.
2021-02-01T01:25:07.983Z        INFO    [index-management]      idxmgmt/std.go:450      Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2021-02-01T01:25:08.294Z        INFO    template/load.go:183    Existing template will be overwritten, as overwrite is enabled.
2021-02-01T01:25:09.703Z        INFO    template/load.go:117    Try loading template filebeat-7.10.0 to Elasticsearch
2021-02-01T01:25:11.383Z        INFO    template/load.go:109    template with name 'filebeat-7.10.0' loaded.
2021-02-01T01:25:11.383Z        INFO    [index-management]      idxmgmt/std.go:298      Loaded index template.
2021-02-01T01:25:11.687Z        INFO    [index-management]      idxmgmt/std.go:309      Write alias successfully generated.
2021-02-01T01:25:11.687Z        INFO    kibana/client.go:119    Kibana url: https://446d849ae30b4df1beb4fcf66ed896d3.australia-southeast1.gcp.elastic-cloud.com:443
2021-02-01T01:25:14.827Z        INFO    kibana/client.go:119    Kibana url: https://446d849ae30b4df1beb4fcf66ed896d3.australia-southeast1.gcp.elastic-cloud.com:443
2021-02-01T01:26:28.206Z        INFO    instance/beat.go:815    Kibana dashboards successfully loaded.
2021-02-01T01:26:28.206Z        WARN    [cfgwarn]       instance/beat.go:556    DEPRECATED: Setting up ML using Filebeat is going to be removed. Please use the ML app to setup jobs. Will be removed in version: 8.0.0
2021-02-01T01:26:28.207Z        INFO    eslegclient/connection.go:99    elasticsearch url: https://a269c7a740a14685ba886ec44532006e.australia-southeast1.gcp.elastic-cloud.com:443
2021-02-01T01:26:29.441Z        INFO    [esclientleg]   eslegclient/connection.go:314   Attempting to connect to Elasticsearch version 7.10.2
2021-02-01T01:26:29.441Z        INFO    kibana/client.go:119    Kibana url: https://446d849ae30b4df1beb4fcf66ed896d3.australia-southeast1.gcp.elastic-cloud.com:443
2021-02-01T01:26:32.877Z        ERROR   instance/beat.go:956    Exiting: 2 errors: Error setting up ML for apache_ecs: 10 errors: ; ; ; ; ; ; ; ; ; ; Error setting up ML for nginx_ecs: 10 errors: ; ; ; ; ; ; ; ; ;

warkolm · February 1, 2021, 1:33am

Thanks. Can you disable the nginx module and try again?

lielar · February 1, 2021, 1:41am

not sure if this is progress, had 2 errors now only have 1. But the 10 other errors remain

See more: https://www.elastic.co/guide/en/machine-learning/current/index.html
Exiting: 1 error: Error setting up ML for apache_ecs: 10 errors: ; ; ; ; ; ; ; ; ;

lielar · February 1, 2021, 1:47am

-7.10.0-linux-x86_64] Data path: [/home/elastic/filebeat-7.10.0-linux-x86_64/data] Logs path: [/home/elastic/filebeat-7.10.0-linux-x86_64/logs]
2021-02-01T01:39:12.915Z        INFO    instance/beat.go:653    Beat ID: 68474046-424d-46a7-ab80-7b5dcdbb778f
2021-02-01T01:39:12.917Z        INFO    [beat]  instance/beat.go:981    Beat info       {"system_info": {"beat": {"path": {"config": "/home/elastic/filebeat
-7.10.0-linux-x86_64", "data": "/home/elastic/filebeat-7.10.0-linux-x86_64/data", "home": "/home/elastic/filebeat-7.10.0-linux-x86_64", "logs": "/home/elast
ic/filebeat-7.10.0-linux-x86_64/logs"}, "type": "filebeat", "uuid": "68474046-424d-46a7-ab80-7b5dcdbb778f"}}}
2021-02-01T01:39:12.917Z        INFO    [beat]  instance/beat.go:990    Build info      {"system_info": {"build": {"commit": "1428d58cf2ed945441fb2ed03961ca
fa9e4ad3eb", "libbeat": "7.10.0", "time": "2020-11-09T19:57:04.000Z", "version": "7.10.0"}}}
2021-02-01T01:39:12.917Z        INFO    [beat]  instance/beat.go:993    Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":2,"v
ersion":"go1.14.7"}}}
2021-02-01T01:39:12.917Z        INFO    [beat]  instance/beat.go:997    Host info       {"system_info": {"host": {"architecture":"x86_64","boot_time":"2021-
01-31T23:44:28Z","containerized":false,"name":"ip-172-31-2-108","ip":["127.0.0.1/8","::1/128","172.31.2.108/20","fe80::ca:52ff:fe98:2bd0/64","172.18.0.1/25"
,"172.17.0.1/16"],"kernel_version":"4.4.0-1119-aws","mac":["02:ca:52:98:2b:d0","02:42:be:a2:a6:4b","02:42:d0:1f:b1:c2"],"os":{"family":"debian","platform":"
ubuntu","name":"Ubuntu","version":"16.04.6 LTS (Xenial Xerus)","major":16,"minor":4,"patch":6,"codename":"xenial"},"timezone":"UTC","timezone_offset_sec":0,
"id":"49a3bdeb77c346b28f71f8be96c3eeb2"}}}
2021-02-01T01:39:12.918Z        INFO    [beat]  instance/beat.go:1026   Process info    {"system_info": {"process": {"capabilities": {"inheritable":null,"pe
rmitted":null,"effective":null,"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","
net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","s
ys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","
wake_alarm","block_suspend","audit_read"],"ambient":null}, "cwd": "/home/elastic/filebeat-7.10.0-linux-x86_64", "exe": "/home/elastic/filebeat-7.10.0-linux-
x86_64/filebeat", "name": "filebeat", "pid": 10386, "ppid": 3108, "seccomp": {"mode":"disabled"}, "start_time": "2021-02-01T01:39:12.150Z"}}}
2021-02-01T01:39:12.918Z        INFO    instance/beat.go:299    Setup Beat: filebeat; Version: 7.10.0
2021-02-01T01:39:12.918Z        INFO    [index-management]      idxmgmt/std.go:184      Set output.elasticsearch.index to 'filebeat-7.10.0' as ILM is enable
d.
2021-02-01T01:39:12.918Z        INFO    eslegclient/connection.go:99    elasticsearch url: https://a269c7a740a14685ba886ec44532006e.australia-southeast1.gcp
.elastic-cloud.com:443
2021-02-01T01:39:12.918Z        INFO    [publisher]     pipeline/module.go:113  Beat name: ip-172-31-2-108
2021-02-01T01:39:12.919Z        INFO    eslegclient/connection.go:99    elasticsearch url: https://a269c7a740a14685ba886ec44532006e.australia-southeast1.gcp
.elastic-cloud.com:443
2021-02-01T01:39:12.920Z        INFO    [add_cloud_metadata]    add_cloud_metadata/add_cloud_metadata.go:93     add_cloud_metadata: hosting provider type de
tected as aws, metadata={"account":{"id":"214514861431"},"availability_zone":"eu-central-1a","image":{"id":"ami-069d12620063ca30c"},"instance":{"id":"i-0081
b0ba887447934"},"machine":{"type":"t2.medium"},"provider":"aws","region":"eu-central-1"}
2021-02-01T01:39:14.182Z        INFO    [esclientleg]   eslegclient/connection.go:314   Attempting to connect to Elasticsearch version 7.10.2
2021-02-01T01:39:14.477Z        INFO    [index-management]      idxmgmt/std.go:261      Auto ILM enable success.
2021-02-01T01:39:14.772Z        INFO    [index-management.ilm]  ilm/std.go:139  do not generate ilm policy: exists=true, overwrite=false
2021-02-01T01:39:14.772Z        INFO    [index-management]      idxmgmt/std.go:274      ILM policy successfully loaded.
2021-02-01T01:39:14.772Z        INFO    [index-management]      idxmgmt/std.go:407      Set setup.template.name to '{filebeat-7.10.0 {now/d}-000001}' as ILM
 is enabled.
2021-02-01T01:39:14.772Z        INFO    [index-management]      idxmgmt/std.go:412      Set setup.template.pattern to 'filebeat-7.10.0-*' as ILM is enabled.
2021-02-01T01:39:14.772Z        INFO    [index-management]      idxmgmt/std.go:446      Set settings.index.lifecycle.rollover_alias in template to {filebeat
-7.10.0 {now/d}-000001} as ILM is enabled.
2021-02-01T01:39:14.772Z        INFO    [index-management]      idxmgmt/std.go:450      Set settings.index.lifecycle.name in template to {filebeat {"policy"
:{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2021-02-01T01:39:15.067Z        INFO    template/load.go:183    Existing template will be overwritten, as overwrite is enabled.
2021-02-01T01:39:16.469Z        INFO    template/load.go:117    Try loading template filebeat-7.10.0 to Elasticsearch
2021-02-01T01:39:18.122Z        INFO    template/load.go:109    template with name 'filebeat-7.10.0' loaded.
2021-02-01T01:39:18.122Z        INFO    [index-management]      idxmgmt/std.go:298      Loaded index template.
2021-02-01T01:39:18.417Z        INFO    [index-management]      idxmgmt/std.go:309      Write alias successfully generated.
2021-02-01T01:39:18.417Z        INFO    kibana/client.go:119    Kibana url: https://446d849ae30b4df1beb4fcf66ed896d3.australia-southeast1.gcp.elastic-cloud.
com:443
2021-02-01T01:39:22.188Z        INFO    kibana/client.go:119    Kibana url: https://446d849ae30b4df1beb4fcf66ed896d3.australia-southeast1.gcp.elastic-cloud.
com:443
2021-02-01T01:40:35.451Z        INFO    instance/beat.go:815    Kibana dashboards successfully loaded.
2021-02-01T01:40:35.452Z        WARN    [cfgwarn]       instance/beat.go:556    DEPRECATED: Setting up ML using Filebeat is going to be removed. Please use 
the ML app to setup jobs. Will be removed in version: 8.0.0
2021-02-01T01:40:35.452Z        INFO    eslegclient/connection.go:99    elasticsearch url: https://a269c7a740a14685ba886ec44532006e.australia-southeast1.gcp
.elastic-cloud.com:443
2021-02-01T01:40:36.695Z        INFO    [esclientleg]   eslegclient/connection.go:314   Attempting to connect to Elasticsearch version 7.10.2
2021-02-01T01:40:36.695Z        INFO    kibana/client.go:119    Kibana url: https://446d849ae30b4df1beb4fcf66ed896d3.australia-southeast1.gcp.elastic-cloud.
com:443
2021-02-01T01:40:38.864Z        ERROR   instance/beat.go:956    Exiting: 1 error: Error setting up ML for apache_ecs: 10 errors: ; ; ; ; ; ; ; ; ;

warkolm · February 1, 2021, 1:52am

Thanks. I don't suppose there is anything in the Elasticsearch logs as well?

lielar · February 1, 2021, 1:55am

Observability Logs


11:38:59.000

nginx.error

[nginx][error] open() "/home/ubuntu/instructions/images/lab1-93846.png" failed (2: No such file or directory), client: 127.0.0.1, server: , request: "GET /instructions/images/lab1-93846.png HTTP/1.1", host: "localhost"

11:38:59.000

nginx.error

[nginx][error] connect() failed (113: No route to host) while connecting to upstream, client: 127.0.0.1, server: , request: "GET /appserv.php HTTP/1.1", upstream: "http://172.18.0.2:5601/appserv.php", host: "localhost"

11:38:59.000

nginx.error

[nginx][error] connect() failed (113: No route to host) while connecting to upstream, client: 127.0.0.1, server: , request: "GET /h1.php HTTP/1.1", upstream: "http://172.18.0.2:5601/h1.php", host: "localhost"

11:38:59.000

nginx.error

[nginx][error] connect() failed (113: No route to host) while connecting to upstream, client: 127.0.0.1, server: , request: "GET /xiaomae.php HTTP/1.1", upstream: "http://172.18.0.2:5601/xiaomae.php", host: "localhost"

11:39:02.000

nginx.access

[nginx][access] 127.0.0.1 training "GET /zshmindex.php HTTP/1.1" 502 157

11:39:02.000

nginx.access

[nginx][access] 127.0.0.1 training "GET /xw.php HTTP/1.1" 502 157

11:39:02.000

nginx.access

[nginx][access] 127.0.0.1 training "GET /l7.php HTTP/1.1" 502 157

11:39:02.000

nginx.access

[nginx][access] 127.0.0.1 training "GET /html/images/favicon.ico HTTP/1.1" 502 157

11:39:02.000

nginx.access

[nginx][access] 127.0.0.1 training "GET /web/phpMyAdmin/index.php HTTP/1.1" 502 157

11:39:02.000

nginx.error

[nginx][error] connect() failed (113: No route to host) while connecting to upstream, client: 127.0.0.1, server: , request: "GET /zshmindex.php HTTP/1.1", upstream: "http://172.18.0.2:5601/zshmindex.php", host: "localhost"

11:39:02.000

nginx.error

[nginx][error] connect() failed (113: No route to host) while connecting to upstream, client: 127.0.0.1, server: , request: "GET /xw.php HTTP/1.1", upstream: "http://172.18.0.2:5601/xw.php", host: "localhost"

11:39:02.000

nginx.error

[nginx][error] connect() failed (113: No route to host) while connecting to upstream, client: 127.0.0.1, server: , request: "GET /l7.php HTTP/1.1", upstream: "http://172.18.0.2:5601/l7.php", host: "localhost"

11:39:02.000

nginx.error

[nginx][error] connect() failed (113: No route to host) while connecting to upstream, client: 127.0.0.1, server: , request: "GET /html/images/favicon.ico HTTP/1.1", upstream: "http://172.18.0.2:5601/html/images/favicon.ico", host: "localhost"

Rich_Raposa · February 9, 2021, 4:22am

What command are you running? If you are running filebeat setup then you can probably ignore the error and move on.

Are you having an error when trying to run filebeat? If so, what does your configuration file look like?

lielar · February 10, 2021, 10:24am

Hi Rich - thanks for replying.

I had not changed the settings more than what was required.

Rich_Raposa · February 10, 2021, 2:26pm

You are running filebeat setup. Ignore the error/warning about ML, just log in to Kibana and see if you have an index pattern for filebeat-*. If you do, then the setup command worked.

system · March 10, 2021, 4:26pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Error trying to setup filebeat Beats filebeat	2	632	December 28, 2020
When trying to run filebeat setup Exiting: 1 error: error loading config file Beats filebeat	2	423	June 25, 2021
Lab 2 Assistance (Observability Fundamentals) Elastic Training	5	576	May 8, 2021
My Filebeat isn't working when pushing Sophos XG firewall logs Beats filebeat	1	278	February 16, 2022
Integrate snort3 with elastic stack using filebeat Beats filebeat	2	706	June 13, 2022

Filesetup is not working

Related Topics