Hello everyone
I'm starting now with ELK. I installed my environment on a lightsail server on AWS and it has the following configuration:
CentOS 7.7.1908
Elasticsearch 7.6.0 - Release 1
Kibana 7.6.0 - Release 1
Logstash 7.6.0
Nginx 1.17.8 - reverse proxy
I managed to make all the configuration of the environment without any difficulty. On the client machine, I configured the filebeat, auditbeat, metricbeat and packetbeat to communicate with Elastisearch on port 9200 and Kibana on port 5601. I did not use Logstash because I was in no way able to make his GeoIP filter work for Nginx logs. No filter just works. With direct sending to Elasticserch the information is displayed without a problem. This however is not the biggest problem I encountered (if anyone knows how to help me with this I appreciate it). The big problem is that every time I access a dashboard (filebeat / auditbeat / metricbeat / packetbeat) I get the following message:
Error fetching fields for index pattern filebeat-7.6.0- * (ID: aa189950-54a4-11ea-a7bd-0768c3c180e6)
Method Not Allowed
When I click to show details, I have this:
_construct @ https: //logserver.domain.com/bundles/commons.bundle.js: 3: 2994490
Wrapper @ https: //logserver.domain.com/bundles/commons.bundle.js: 3: 2993589
HttpFetchError @ https: //logserver.domain.com/bundles/commons.bundle.js: 3: 2995366
fetchResponse $ @ https: //logserver.domain.com/bundles/commons.bundle.js: 3: 2991052
s @ https: //logserver.domain.com/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js: 338: 774546
l / i._invoke </ <@https: //logserver.domain.com/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js: 338: 774300
v / </ e [t] @https: //logserver.domain.com/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js: 338: 774903
s @ https: //logserver.domain.com/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js: 338: 774546
t @ https: //logserver.domain.com/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js: 338: 775042
t / <@https: //logserver.domain.com/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js: 338: 775192
My index pattern is: filebeat-7.6.0- * (default) / metricbeat- * / auditbeat- * / packetbeat- *
My indexes are: packetbeat-7.6.0-2020.02.21-000001 /
metricbeat-7.6.0-2020.02.21-000001 / filebeat-7.6.0-2020.02.21-000001 / auditbeat-7.6.0-2020.02.21-000001
Can someone help me?
Thank you. Cheers
Andre