Help: Metricbeat to elasticsearch using ipv6

Elastic Stack Beats
1

I have elasticsearch/Kibana setup on another host and configured basic authentication. now I am trying to configure metricbeat to send some data (over ipv6) but I cant seem to figure out why its failing to authenticate when I try to run metricbeat setup. (ive tried both with and without using keystore). It works fine if I do a test curl -6 -u. e.g.
root@10-245-76-9:/etc/metricbeat# curl -6 http://[2a00:47c0:511:1297:7aae:5e12:607f:7372]:9200 -u bk-test:Testing1234
{
"name" : "10-245-76-12",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "NOvxDXzaSVaOJynxfr8a6A",
"version" : {
"number" : "7.5.0",
"build_flavor" : "default",
"build_type" : "deb",
"build_hash" : "e9ccaed468e2fac2275a3761849cbee64b39519f",
"build_date" : "2019-11-26T01:06:52.518245Z",
"build_snapshot" : false,
"lucene_version" : "8.3.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"

root@10-245-76-9:/etc/metricbeat# metricbeat setup
Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch http://[2a00:47c0:511:1297:7aae:5e12:607f:7372]:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401}]

root@10-245-76-9:/etc/metricbeat# metricbeat test output
elasticsearch: http://[2a00:47c0:511:1297:7aae:5e12:607f:7372]:9200...
parse url... OK
connection...
parse host... ERROR address 2a00:47c0:511:1297:7aae:5e12:607f:7372:9200: too many colons in address

my metricbeat.yml has the following elements:
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:

Array of hosts to connect to.

hosts: ["http://[2a00:47c0:511:1297:7aae:5e12:607f:7372]:9200"]

Optional protocol and basic auth credentials.

#protocol: "https"
username: "bk-test"
password: "${bk-test}"

any advise?

2

Hey!

could you try with https://... and see if this changes anything?

Thanks!

3

Hi, I tried to make it https but still the same error.

metricbeat test output
elasticsearch: https://[2a00:47c0:511:1297:7aae:5e12:607f:7372]:9200...
parse url... OK
connection...
parse host... ERROR address 2a00:47c0:511:1297:7aae:5e12:607f:7372:9200: too many colons in address

4

I think that the command is test output is buggy here since it removes [ from the address. I will check it further.

However did you try with metricbeat setup or metricbeat -e -d "*"? This is irrelevant to test output.

5

Thanks Chris. Yes looks broken. separate from this I have found an issue with the formatting in my .yml file (usuername/password in the wrong column). So metricbeat is now running (despite the output error msg). regards, Brian.

6

Good to know!

Here is the Github issue for reference: https://github.com/elastic/beats/issues/15078

Regards!

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.