Hi, I am trying to join Kibana and Nagios

Hi, I am trying to join Kibana and Nagios, following this link: https://www.elastic.co/es/blog/integrating-nagios-checks-with-logstash

But I get some errors which I cant resolve it, any ideas? Thanks.

root@nagios:/home/nagios# cd /usr/share/logstash/bin/logstash-plugin
bash: cd: /usr/share/logstash/bin/logstash-plugin: Not a directory
root@nagios:/home/nagios# cd /usr/share/logstash/bin/
root@nagios:/usr/share/logstash/bin# ./logstash-plugin install logstash-input-nagioscheck
OpenJDK 64-Bit Server VM warning: Ignoring option UseConcMarkSweepGC; support was removed in 14.0
OpenJDK 64-Bit Server VM warning: Ignoring option CMSInitiatingOccupancyFraction; support was removed in 14.0
OpenJDK 64-Bit Server VM warning: Ignoring option UseCMSInitiatingOccupancyOnly; support was removed in 14.0
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.headius.backport9.modules.Modules to method sun.nio.ch.NativeThread.signal(long)
WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
Validating logstash-input-nagioscheck
Installing logstash-input-nagioscheck
Installation successful
root@nagios:/usr/share/logstash/bin# ./logstash --modules nagios --setup
OpenJDK 64-Bit Server VM warning: Ignoring option UseConcMarkSweepGC; support was removed in 14.0
OpenJDK 64-Bit Server VM warning: Ignoring option CMSInitiatingOccupancyFraction; support was removed in 14.0
OpenJDK 64-Bit Server VM warning: Ignoring option UseCMSInitiatingOccupancyOnly; support was removed in 14.0
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/usr/share/logstash/logstash-core/lib/jars/jruby-complete-9.2.11.1.jar) to method sun.nio.ch.NativeThread.signal(long)
WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN ] 2020-05-31 08:50:24.645 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2020-05-31 08:50:24.731 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"7.7.0"}
[INFO ] 2020-05-31 08:50:26.724 [Agent thread] modulescommon - Setting up the nagios module
[ERROR] 2020-05-31 08:50:28.280 [Agent thread] kibanaclient - Error when executing Kibana client request {:error=>#<Manticore::SocketException: Connection refused>}
[ERROR] 2020-05-31 08:50:28.917 [Agent thread] kibanaclient - Error when executing Kibana client request {:error=>#<Manticore::SocketException: Connection refused>}
[ERROR] 2020-05-31 08:50:29.163 [Agent thread] sourceloader - Could not fetch all the sources {:exception=>LogStash::ConfigLoadingError, :message=>"Failed to import module configurations to Elasticsearch and/or Kibana. Module: nagios has Elasticsearch hosts: ["localhost:9200"] and Kibana hosts: ["localhost:5601"]", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:124:in `block in pipeline_configs'", "org/jruby/RubyArray.java:1809:in ` each'", "/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:70:in `pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source/modules.rb:30:in ` pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:77:in `block in fetch'", "org/jruby/RubyArray.java:2572:in ` collect'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:76:in `fetch'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:165:in ` converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:113:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:390:in ` block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]} [ERROR] 2020-05-31 08:50:29.186 [Agent thread] agent - An exception happened when converging configuration {:exception=>RuntimeError, :message=>"Could not fetch the configuration, message: Failed to import module configurations to Elasticsearch and/or Kibana. Module: nagios has Elasticsearch hosts: ["localhost:9200"] and Kibana hosts: ["localhost:5601"]", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/agent.rb:172:in ` converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:113:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:390:in ` block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}
[INFO ] 2020-05-31 08:50:30.254 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2020-05-31 08:50:34.462 [LogStash::Runner] runner - Logstash shut down.

Initially, it seems like you cannot reach the configured hosts.... are elasticsearch, kibana and logstash all on the same machine ?

How are the configured, please provide configuration yaml files so we can determine potential misconfigurations or issues.

Elasticsearch, kibana and logstash in its different machine.

[root@localhost bin]# ./logstash --modules nagios --setup
Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[INFO ] 2022-04-06 08:02:19.141 [main] runner - Starting Logstash {"logstash.version"=>"7.17.1", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.13+8 on 11.0.13+8 +indy +jit [linux-x86_64]"}
[INFO ] 2022-04-06 08:02:19.146 [main] runner - JVM bootstrap flags: [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -Djruby.regexp.interruptible=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true]
[WARN ] 2022-04-06 08:02:19.696 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2022-04-06 08:02:21.316 [Agent thread] modulescommon - Setting up the nagios module
[INFO ] 2022-04-06 08:02:21.454 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9601, :ssl_enabled=>false}
[ERROR] 2022-04-06 08:02:22.190 [Agent thread] kibanaclient - Error when executing Kibana client request {:error=>#<Manticore::SocketException: Connect to localhost:5601 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused (Connection refused)>}
[ERROR] 2022-04-06 08:02:22.454 [Agent thread] kibanaclient - Error when executing Kibana client request {:error=>#<Manticore::SocketException: Connect to localhost:5601 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused (Connection refused)>}
[ERROR] 2022-04-06 08:02:22.532 [Agent thread] sourceloader - Could not fetch all the sources {:exception=>LogStash::ConfigLoadingError, :message=>"Failed to import module configurations to Elasticsearch and/or Kibana. Module: nagios has Elasticsearch hosts: ["localhost:9200"] and Kibana hosts: ["localhost:5601"]", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:124:in block in pipeline_configs'", "org/jruby/RubyArray.java:1821:in each'", "/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:70:in pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source/modules.rb:29:in pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:76:in block in fetch'", "org/jruby/RubyArray.java:2584:in collect'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:75:in fetch'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:182:in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:120:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:419:in block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}
[ERROR] 2022-04-06 08:02:22.535 [Agent thread] agent - An exception happened when converging configuration {:exception=>RuntimeError, :message=>"Could not fetch the configuration, message: Failed to import module configurations to Elasticsearch and/or Kibana. Module: nagios has Elasticsearch hosts: ["localhost:9200"] and Kibana hosts: ["localhost:5601"]"}
[INFO ] 2022-04-06 08:02:22.659 [LogStash::Runner] runner - Logstash shut down.

I see a lot of localhost references, but if they are all on different machines, use an IP address or a Fully qualified domain name to access / connect to them

In which file do I put this IPaddress?

You have Elasticsearch, Kibana, Logstash and the Nagios module... to help we would need to see all the configuration yaml files.

You need to replace localhost with the IP address of the machine that service is running, however to use an IP address might need additional configuration of the default setup of that service, like for example making sure you can expose the service to clients outside of the host machine, meaning clients not running on the same machine.

I know this solution, but where do I find the settings file?

Settings file for what ? Elasticsearch, kibana and logstash ? Depending on your installation this will differ, you must have edited these files to set them up.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.