In my local environment, I must use IP Address instead of Localhost or other nickname. My settup is Docker over Virtual Box instead of Docker For Windows. It is not part of my question discuss why I am using Virtual Box instead of HyperV but only for superficial explanation I use also Minishift for other projects (free OpenShift) and it depends on Virtualbox.
I have noted that I must use Docker Machine IP address in some places that most of Hello World tutorials just use localhost, 127.0.0.1 or the name of the container.
After I enable xpack security Logstash can't connect to Elasticsearch poping up this error
... Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/' ... Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/_xpack'"
I am not sure this is the issue but I would like try force Logstash connect to Elasticsearch throw my Docker Machine IP address (http://192.168.99.100:9200)
Is it possible? If so, how?
Here are my docker-compose.yml
`
version: '3.2'
services:
*** zookpeeper, kafka and filebeat removed
elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch:7.7.0
environment:
- cluster.name=docker-cluster
- bootstrap.memory_lock=true
- "ES_JAVA_OPTS=-Xms512m -Xmx512m"
- xpack.security.enabled=true
- xpack.security.http.ssl.enabled=false
- discovery.type=single-node
ulimits:
memlock:
soft: -1
hard: -1
volumes:
- "//c/Users/mycomp/docker_folders/esdata:/usr/share/elasticsearch/data"
ports:
- "9200:9200"
kibana:
image: docker.elastic.co/kibana/kibana:7.7.0
volumes:
- "//c/Users/mycomp/docker_folders/kibana.yml:/usr/share/kibana/config/kibana.yml"
restart: always
environment:
- SERVER_NAME=kibana.localhost
- ELASTICSEARCH_HOSTS=http://192.168.99.100:9200
ports:
- "5601:5601"
links:
- elasticsearch
depends_on:
- elasticsearch
logstash:
image: docker.elastic.co/logstash/logstash:7.7.0
volumes:
- "//c/Users/mycomp/docker_folders/logstash.conf:/config-dir/logstash.conf"
restart: always
command: logstash -f /config-dir/logstash.conf
ports:
- "9600:9600"
- "7777:7777"
links:
- elasticsearch
- kafka1
`
logstash.conf
`
xpack.monitoring.elasticsearch.hosts: ["http://192.168.99.100:9200"]
xpack.monitoring.elasticsearch.username: "logstash_system"
xpack.monitoring.elasticsearch.password: => "l12345"
input{
kafka{
codec => "json"
bootstrap_servers => "kafka1:9092"
topics => ["app_logs","request_logs"]
tags => ["app"]
}
}
filter {
*** removed
}
output {
elasticsearch {
hosts => ["http://192.168.99.100:9200"]
index => "logstash-{+YYYY.MM.dd}"
user => "userlog"
password => "userlog"
}
}
`
Complete Logs
logstash_1 | WARNING: All illegal access operations will be denied in a future release logstash_1 | Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties logstash_1 | [2020-05-21T12:41:12,468][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified logstash_1 | [2020-05-21T12:41:12,488][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.7.0"} logstash_1 | [2020-05-21T12:41:13,543][WARN ][logstash.monitoringextension.pipelineregisterhook] xpack.monitoring.enabled has not been defined, but found elasticsearch configuration. Please explicitly setxpack.monitoring.enabled: truein logstash.yml logstash_1 | [2020-05-21T12:41:13,548][WARN ][deprecation.logstash.monitoringextension.pipelineregisterhook] Internal collectors option for Logstash monitoring is deprecated and targeted for removal in the next major version. logstash_1 | Please configure Metricbeat to monitor Logstash. Documentation can be found at: logstash_1 | https://www.elastic.co/guide/en/logstash/current/monitoring-with-metricbeat.html logstash_1 | [2020-05-21T12:41:15,361][INFO ][logstash.licensechecker.licensereader] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://elasticsearch:9200/]}} logstash_1 | [2020-05-21T12:41:15,763][WARN ][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://elasticsearch:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/'"} logstash_1 | [2020-05-21T12:41:15,861][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/_xpack'"} logstash_1 | [2020-05-21T12:41:15,939][ERROR][logstash.monitoring.internalpipelinesource] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster. logstash_1 | [2020-05-21T12:41:16,538][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"input\", \"filter\", \"output\" at line 1, column 1 (byte 1)", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:58:incompile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:66:in compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:28:in block in compile_sources'", "org/jruby/RubyArray.java:2577:in map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:27:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:181:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:67:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:43:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:342:in block in converge_state'"]} logstash_1 | [2020-05-21T12:41:17,011][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600} logstash_1 | [2020-05-21T12:41:21,818][INFO ][logstash.runner ] Logstash shut down. dockercomposelogs_logstash_1 exited with code 1