Invalid control character in URL?

Elastic Stack Beats
1

See also below:
I have found lots of errors in the syslog. They are all coming from PacketBeats.
But I have no clue what this means; let alone what to do with it.
Any suggestions?

Thanks - Will

Mar 10 17:30:11 tank packetbeat[2138]: POST /_bulk: net/url: invalid control character in URL
Mar 10 17:30:11 tank packetbeat[2138]: 2020-03-10T17:30:11.874+0100#011WARN#011http/http.go:533#011Fail to parse HTTP parameters: parse LTS (Bionic Beaver)","family":"debian","name$
Mar 10 17:30:11 tank packetbeat[2138]: {"create":{"_index":"packetbeat-7.6.1","pipeline":"geoip-info"}}
Mar 10 17:30:11 tank packetbeat[2138]: {"@timestamp":"2020-03-10T16:30:10.244Z","tags":["your-friend-the-network","packet-data"],"destination":{"port":9200,"packets":2,"bytes":132,$
Mar 10 17:30:11 tank packetbeat[2138]: POST /_bulk: net/url: invalid control character in URL
Mar 10 17:30:12 tank packetbeat[2138]: 2020-03-10T17:30:12.408+0100#011WARN#011http/http.go:533#011Fail to parse HTTP parameters: parse {"create":{"_index":"packetbeat-7.6.1","pipe$
Mar 10 17:30:12 tank packetbeat[2138]: {"@timestamp":"2020-03-10T16:30:10.244Z","flow":{"final":false,"id":"EQwA////DP//////FBgBAAEADCl9tXYADsTQXoXAqIubwKiL7/AjBN5GRAAAAAAAAA"},"ta$
Mar 10 17:30:12 tank packetbeat[2138]: POST /_bulk: net/url: invalid control character in URL
Mar 10 17:30:12 tank packetbeat[2138]: 2020-03-10T17:30:12.816+0100#011WARN#011http/http.go:533#011Fail to parse HTTP parameters: parse {"create":{"_index":"packetbeat-7.6.1","pipe$
Mar 10 17:30:12 tank packetbeat[2138]: {"@timestamp":"2020-03-10T16:30:10.244Z","flow":{"final":false,"id":"EQwA////DP//////FBgBAAEADsTQXoWwf7mKyhnAqIvvH7rzfl6suwE6RgAAAAAAAA"},"ne$
Mar 10 17:30:12 tank packetbeat[2138]: POST /_bulk: net/url: invalid control character in URL
Mar 10 17:30:13 tank packetbeat[2138]: 2020-03-10T17:30:13.498+0100#011WARN#011http/http.go:533#011Fail to parse HTTP parameters: parse LTS (Bionic Beaver)","family":"debian","name$
Mar 10 17:30:13 tank packetbeat[2138]: {"create":{"_index":"packetbeat-7.6.1","pipeline":"geoip-info"}}
Mar 10 17:30:13 tank packetbeat[2138]: {"@timestamp":"2020-03-10T16:30:10.244Z","destination":{"packets":76,"mac":"00:0c:29:7d:b5:76","ip":"192.168.139.155","port":9200,"bytes":899$
Mar 10 17:30:13 tank packetbeat[2138]: POST /_bulk: net/url: invalid control character in URL
2

Do you have any idea what kind of URL might it be? I expect some weird character like /r ...

3

No - don't know.
Also don't know where to look for this => suggestions?

4

ot the same problem … it was working before, now I cloned it onto a new Workstation and it refused to launch

Windows 10, Chrome 72.0.3626.121 (64Bit) official site
, go version go1.12 windows/amd64

5

I assume you can record some network traffic and look for patterns. You will find patterns in packetbeat logs.

6

Yes - could do that.

However, my main concern is the amount of entries in the log saying {"create":{"_index":"packetbeat-7.6.1","pipeline":"geoip-info"}.

Why creating this many new indices?
Does this mean that something is missing within ES? If yes - what?

I have done packetbeat setup => wouldn't expect this.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.