Icmp not responding as expected in Elastic

Hey, I setup my heartbeat monitoring and I have configured all three kind of monitors: http, tcp and icmp. So I got tcp and http to work correctly, but no luck with icmp (which is the one I actually need). So I am checking the status of host: [""] so I think the status should be "up" all the time, but I constantly get status "down".

In terminal i can see the message and it seems ok.

My configuration is:

# Configure monitors inline
- type: icmp
  id: icmp-google-dns
  name: icmp google dns
  hosts: [""]
  schedule: "@every 10s"
  tags: ["service:icmp", "org:google"]
- type: http
  schedule: '@every 10s'
  urls: ["http://google.com"]
  id: http-google-dns
  name: http google dns test
  tags: ["service:http", "org:google"]
- type: tcp
  id: tcp-local-kafka
  name: tcp local kafka
  hosts: ["localhost:9092"]
  schedule: "@every 10s"
  tags: ["service:tcp", "org:local-kafka"]

And the output I get from terminal is:

{"log.level":"info","@timestamp":"2023-03-30T07:59:36.622Z","log.origin":{"file.name":"logger/logger.go","file.line":97},"message":"Monitor finished","service.name":"heartbeat","event":{"action":"monitor.run"},"monitor":{"id":"tcp-local-kafka","type":"tcp","duration":{"ms":0}},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-03-30T07:59:36.622Z","log.origin":{"file.name":"logger/logger.go","file.line":97},"message":"Monitor finished","service.name":"heartbeat","event":{"action":"monitor.run"},"monitor":{"id":"icmp-google-dns","type":"icmp","duration":{"ms":0}},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-03-30T07:59:36.645Z","log.origin":{"file.name":"logger/logger.go","file.line":97},"message":"Monitor finished","service.name":"heartbeat","event":{"action":"monitor.run"},"monitor":{"id":"http-google-dns","type":"http","duration":{"ms":23}},"ecs.version":"1.6.0"}

Also image from the Elastic Dashboard:

Thank you in advance for the help,


Okay this is solved. I overlooked the icmp options on the webpage: ICMP options | Heartbeat Reference [8.6] | Elastic

The part: Run sudo setcap cap_net_raw+eip /path/to/heartbeat to grant Heartbeat ping capabilities on Linux

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.