Heartbeat on Docker not receiving logs in Kibana

Elastic Stack Beats
,
1

This is my config:

heartbeat.monitors:
- type: http
  enabled: true
  schedule: '@every 10s'
  urls: ["http://localhost:9200"]  # Elasticsearch
- type: tcp
  enabled: true
  schedule: '@every 10s'
  hosts: ["localhost:5044"]  # Logstash Beats input
- type: http
  enabled: true
  schedule: '@every 10s'
  urls: ["http://localhost:5601"]  # Kibana
- type: http
  enabled: true
  schedule: '@every 10s'
  urls:
    - "http://localhost:2375/containers/json"  # Docker API endpoint for listing containers

output.logstash:
  hosts: ["127.0.0.1:5044"]  # Logstash Beats input

Instead of localhost I've also tried 10.100.10.36 (the IP of the server) but isn't working. Checking docker logs I don't seem to have any errors. Any advice?

2

Hi @roman-tasi,

Thanks for reaching out!

How are you executing heartbeat? Do you mean that you are not even seeing the HB logs when looking at the terminal? Have you tried to go inside the docker container and execute HB manually?

Are those addresses reachable within the docker container?

Thanks,
Alberto

3

I am starting Heartbeat by running this command in the terminal:

docker run -d \
--name=heartbeat \
--user=root \
--volume="$(pwd)/heartbeat.docker.yml:/usr/share/heartbeat/heartbeat.yml:ro" \
--cap-add=NET_RAW \
docker.elastic.co/beats/heartbeat:8.12.1 \
--strict.perms=false -e \
-E output.logstash.hosts=["10.100.10.36:5044"]

I can see the HB logs by running docker logs heartbeat --follow

Have you tried to go inside the docker container and execute HB manually?

Are those addresses reachable within the docker container?

I can enter the container by running docker exec -it heartbeat sh and see that the correct config is being applied, but not sure how to exactly answer your questions.

4

@Alberto_Delgado ^ Sorry to tag you

5

Hi @roman-tasi,

No problem with the tagging. Apologies for the delay!

I'm trying to understand what is the exact situation you are facing.

My understanding after seeing your second comment is that everything works well, meaning that you can see everything being executed locally, etc.

I'll try to configure a setup similar to yours locally and share with you the steps I followed. (and confirm that I'm seeing everything)

Before that, please, let me confirm your setup:

  • using HB to ping a few URLs (with TCP and http)
  • you are doing that locally through docker
  • you are not setting the Elasticsearch output but the Logtash one instead.

Is this correct?

Btw, is Logtash running in your host or is it in another docker container?

Another thing that I need to confirm if possible:

When you say that you don't see the logs in Kibana, what logs are you referring to? Do you mean the results of the pings? (your http and TCP monitors) or do you mean other kinds of logs?

Could you share a screenshot of the page in Kibana where you are expecting to see those logs? I'm trying to have more context to provide you with a better guidance

Thanks,
Alberto

6

Hi again,

To use Logtash output have you followed the steps mentioned in the part of the docs?

For instance, have you followed this step?

" The hosts option specifies the Logstash server and the port (5044) where Logstash is configured to listen for incoming Beats connections.

For this configuration, you must load the index template into Elasticsearch manually because the options for auto loading the template are only available for the Elasticsearch output."

P.S. Also might be interesting to check this: Run Heartbeat on Docker | Heartbeat Reference [8.12] | Elastic

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.