Http module: "invalid character '<' looking for beginning of value"

Elastic Stack Beats
1

Hi all,
My first steps with Elastic, so maybe a dumb question. Running 6.4.0 with Metricbeat http module polling a SmartMeter.

Test with Google Chrome:
http://192.168.13.50:8080/xml/json.php?mode=infomin
JSON Reply of SmartMeter:
{"devicetype":"ALL3690","devicename":"ALL3690","softversion":"320","patchlevel":"1052","revision":"0.02"}

http.yml

  • module: http
    metricsets: ["json"]
    period: 5s
    hosts: ["192.168.13.50:8080"]
    namespace: "json_namespace"
    path: "/xml/json.php?mode=infomin"

Metricbeat debug output:
"@timestamp": "2018-09-11T07:48:45.447Z",
"@metadata": {
"beat": "metricbeat",
"type": "doc",
"version": "6.4.0"
},
"error": {
"message": "invalid character '<' looking for beginning of value"
},
"metricset": {
"name": "json",
"module": "http",
"host": "192.168.13.50:8080",
"rtt": 2969
},
"beat": {
"name": "SBU",
"hostname": "SBU",
"version": "6.4.0"
},
"host": {
"name": "SBU"
}
}

Any ideas what is wrong? Configuration? Malformed JSON reply? Thanks in advance.

2

Hi @MarkusB :slight_smile:

I'm not sure about the root of your issue but that message is the error of Go trying to parse a JSON but that has probably received an HTML (like <html><head>...) That's why it is warning about the < character at the beginning.

It's probably not making the request where you are expecting or to the path you are expecting. I'd try to set the path without the first / and set the host with the http:// schema just in case. Also if you have an Nginx or some proxy, I'll review there just in case.

Best regards.

3

Hi @Mario_Castro

Thanks for your quick reply. I tried both of your hints with the same result. So if it's not an obvious configuration fault, I'll set up Wireshark to find out what is going back and forth.

Kind regards

4

Can you paste the curl output of curl -vvvv http://192.168.13.50:8080/xml/json.php?mode=infomin?

Maybe it's something with the Content-Type of the headers

5

With Wireshark I found out that the GET string ends up like:
http://192.168.13.50:8080/xml/json.php%3Fmode=infomin

So the reply of the SmartMeter is 404 page not found because of the %3F in the URL.
The big question is also how to get the ? in the URL instead of %3F replacement...

6

I have been able to reproduce it locally and it seems like a bug in the http module.

I have opened an issue in Github to follow the fix, you can find it here: https://github.com/elastic/beats/issues/8286

Thanks for reporting!

7

Hi @MarkusB

Just to follow up, we have added a parameter to solve this kind of issue, you can see the merged PR here https://github.com/elastic/beats/pull/8292/#pullrequestreview-154757159

Again, thanks for reporting!

8

Hi @Mario_Castro
Thanks a lot for the quick solution and for keeping me in the loop. The current downloadable Metricbeat version is 6.4.1 which does not contain your recent changes. When do you think the next release will be available? Is there a fixed schedule?

9

Not really, but in this case I guess that it will be released soon, probably in the next version which is 6.4.2

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.