Hello,
I send the logs to ELK via Qradar. I can see the logs with TCPdump, but I cannot access the logs in the Kibana interface.
Elasticsearch, Logstash, Kibana are all installed on a single server.
Old sent logs are seen, but I can't see the current logs I sent on kibana.
I am new to ELK, I am waiting for your help.
Hi @pofudukhamsi,
Welcome! I'm not familiar with Qradar, but I assume you are using Logstash to pull the logs. Do you see any error messages on the Logstash or Elasticsearch side?
If you could share your Logstash configuration that you are using to send and any error messages that would be useful.
Welcome to the forum, I hope we can help you.
Just trying to understand what you mean by "seen" there - some logs sent by Radar are seen in the kibana interface, so it was working, or partially working in past ?
btw I've seen issues like this when there is just time zone confusion
Can you run following command in Kibana dev tools
GET /_cat/indices
wait a few minutes, enough time for a bunch more logs to have been generated, then run it again
GET /_cat/indices
and see what has changed, which will show if documents are being indexed.
If you have shell access you can do this all in one line via, set EUSER, EPASS, EHOST, EPORT to your own values, change "sleep 60" to however many seconds you think is appropriate here.
diff <(sleep 60 && curl -s -k -u "${EUSER}":"${EPASS}" "https://${EHOST}:${EPORT}/_cat/indices/*?expand_wildcards=all&v=true&s=docs.count&bytes=b&h=health,index,uuid,pri,rep,docs.count"| sed 1d) <(curl -s -k -u "${EUSER}":"${EPASS}" "https://${EHOST}:${EPORT}/_cat/indices/*?expand_wildcards=all&v=true&s=docs.count&bytes=b&h=health,index,uuid,pri,rep,docs.count")
Hello,
Please review the logstash service if it is running?
Check the logstash logs to see if it is processing the logs & sending to elasticsearch?
Thanks!!
Hello,
I ran the commands you requested and no change is visible.
Hello,
Logstash is working, there doesn't seem to be any problem.
Hello,
How do I look at the error messages in Logstash and Elasticsearch?
I am new to ELK.
It depends on where you are running, which you haven't mentioned. For DEB/RPM Logstash they are normally in /var/log/logstash. The details are here in the documentation.
For Elasticsearch it's a similar situation if running your own (/var/log/elasticsearch):
Elasticsearch application logging | Elasticsearch Guide [8.17] | Elastic.
That's assuming they you haven't specified a different location.
Hope that helps!
Hello,
This ELK is a very old version. Elasticsearch, Logstash and Kibana are available on a single server.
grep -i ‘error’ /var/log/elasticsearch/elasticsearch.log
I ran this command, I share the output in the attachment.
Which version are you using @pofudukhamsi? I'm guessing 6.4.2 from the logs which is past EOL as per the policy. We would recommend upgrading if you can.
Do you just have error messages? Are there any warnings that we can't see due to the grep filter? It looks like there is an error but it's not quite clear what's causing it form your log snippet.
problem here (outside posting pictures of text which is not very nice) is that by grep-ing for error, you miss a lot of important information about the error.
e.g. the o.e.b.bootstrap ERROR is an "Exception", probably on following lines it'll explain a little more about the reason for the exception.
In short, would be better to post the actual log (as text), or a link to same on some cloud service.
Hello,
I am trying to meet the steps you want with minimum information 
, if you explain the steps to me in detail, I can tell you which commands are required respectively.
[root@lockout ~]# tail -n 100 /var/log/elasticsearch/elasticsearch.log
[2025-02-04T09:01:15,036][INFO ][o.e.p.PluginsService ] [k3NhRcs] loaded module [x-pack-deprecation]
[2025-02-04T09:01:15,036][INFO ][o.e.p.PluginsService ] [k3NhRcs] loaded module [x-pack-graph]
[2025-02-04T09:01:15,036][INFO ][o.e.p.PluginsService ] [k3NhRcs] loaded module [x-pack-logstash]
[2025-02-04T09:01:15,036][INFO ][o.e.p.PluginsService ] [k3NhRcs] loaded module [x-pack-ml]
[2025-02-04T09:01:15,036][INFO ][o.e.p.PluginsService ] [k3NhRcs] loaded module [x-pack-monitoring]
[2025-02-04T09:01:15,036][INFO ][o.e.p.PluginsService ] [k3NhRcs] loaded module [x-pack-rollup]
[2025-02-04T09:01:15,036][INFO ][o.e.p.PluginsService ] [k3NhRcs] loaded module [x-pack-security]
[2025-02-04T09:01:15,036][INFO ][o.e.p.PluginsService ] [k3NhRcs] loaded module [x-pack-sql]
[2025-02-04T09:01:15,036][INFO ][o.e.p.PluginsService ] [k3NhRcs] loaded module [x-pack-upgrade]
[2025-02-04T09:01:15,036][INFO ][o.e.p.PluginsService ] [k3NhRcs] loaded module [x-pack-watcher]
[2025-02-04T09:01:15,036][INFO ][o.e.p.PluginsService ] [k3NhRcs] no plugins loaded
[2025-02-04T09:01:18,179][INFO ][o.e.x.s.a.s.FileRolesStore] [k3NhRcs] parsed [0] roles from file [/etc/elasticsearch/roles.yml]
[2025-02-04T09:01:18,550][INFO ][o.e.x.m.j.p.l.CppLogMessageHandler] [controller/8694] [Main.cc@109] controller (64 bit): Version 6.4.2 (Build 660eefe6f2ea55) Copyright (c) 2018 Elasticsearch BV
[2025-02-04T09:01:18,846][DEBUG][o.e.a.ActionModule ] Using REST wrapper from plugin org.elasticsearch.xpack.security.Security
[2025-02-04T09:01:21,289][INFO ][o.e.d.DiscoveryModule ] [k3NhRcs] using discovery type [zen]
[2025-02-04T09:01:21,992][INFO ][o.e.n.Node ] [k3NhRcs] initialized
[2025-02-04T09:01:21,992][INFO ][o.e.n.Node ] [k3NhRcs] starting ...
[2025-02-04T09:01:22,191][ERROR][o.e.b.Bootstrap ] [k3NhRcs] Exception
org.elasticsearch.transport.BindTransportException: Failed to bind to [9300-9400]
at org.elasticsearch.transport.TcpTransport.bindToPort(TcpTransport.java:821) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.transport.TcpTransport.bindServer(TcpTransport.java:786) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.transport.netty4.Netty4Transport.doStart(Netty4Transport.java:134) ~[?:?]
at org.elasticsearch.xpack.core.security.transport.netty4.SecurityNetty4Transport.doStart(SecurityNetty4Transport.java:87) ~[?:?]
at org.elasticsearch.xpack.security.transport.netty4.SecurityNetty4ServerTransport.doStart(SecurityNetty4ServerTransport.java:41) ~[?:?]
at org.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:66) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.transport.TransportService.doStart(TransportService.java:217) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:66) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.node.Node.start(Node.java:667) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Bootstrap.start(Bootstrap.java:265) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:335) [elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) [elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127) [elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) [elasticsearch-cli-6.4.2.jar:6.4.2]
at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) [elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86) [elasticsearch-6.4.2.jar:6.4.2]
Caused by: java.net.BindException: Cannot assign requested address
at sun.nio.ch.Net.bind0(Native Method) ~[?:?]
at sun.nio.ch.Net.bind(Net.java:461) ~[?:?]
at sun.nio.ch.Net.bind(Net.java:453) ~[?:?]
at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:222) ~[?:?]
at io.netty.channel.socket.nio.NioServerSocketChannel.doBind(NioServerSocketChannel.java:128) ~[?:?]
at io.netty.channel.AbstractChannel$AbstractUnsafe.bind(AbstractChannel.java:558) ~[?:?]
at io.netty.channel.DefaultChannelPipeline$HeadContext.bind(DefaultChannelPipeline.java:1283) ~[?:?]
at io.netty.channel.AbstractChannelHandlerContext.invokeBind(AbstractChannelHandlerContext.java:501) ~[?:?]
at io.netty.channel.AbstractChannelHandlerContext.bind(AbstractChannelHandlerContext.java:486) ~[?:?]
at io.netty.channel.DefaultChannelPipeline.bind(DefaultChannelPipeline.java:989) ~[?:?]
at io.netty.channel.AbstractChannel.bind(AbstractChannel.java:254) ~[?:?]
at io.netty.bootstrap.AbstractBootstrap$2.run(AbstractBootstrap.java:365) ~[?:?]
at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163) ~[?:?]
at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:403) ~[?:?]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:463) ~[?:?]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) ~[?:?]
at java.lang.Thread.run(Thread.java:750) ~[?:1.8.0_412]
[2025-02-04T09:01:22,200][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: BindTransportException[Failed to bind to [9300-9400]]; nested: BindException[Cannot assign requested address];
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:140) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.4.2.jar:6.4.2]
at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86) ~[elasticsearch-6.4.2.jar:6.4.2]
Caused by: org.elasticsearch.transport.BindTransportException: Failed to bind to [9300-9400]
at org.elasticsearch.transport.TcpTransport.bindToPort(TcpTransport.java:821) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.transport.TcpTransport.bindServer(TcpTransport.java:786) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.transport.netty4.Netty4Transport.doStart(Netty4Transport.java:134) ~[?:?]
at org.elasticsearch.xpack.core.security.transport.netty4.SecurityNetty4Transport.doStart(SecurityNetty4Transport.java:87) ~[?:?]
at org.elasticsearch.xpack.security.transport.netty4.SecurityNetty4ServerTransport.doStart(SecurityNetty4ServerTransport.java:41) ~[?:?]
at org.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:66) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.transport.TransportService.doStart(TransportService.java:217) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:66) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.node.Node.start(Node.java:667) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Bootstrap.start(Bootstrap.java:265) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:335) ~[elasticsearch-6.4.2.jar:6.4.2]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.4.2.jar:6.4.2]
... 6 more
Caused by: java.net.BindException: Cannot assign requested address
at sun.nio.ch.Net.bind0(Native Method) ~[?:?]
at sun.nio.ch.Net.bind(Net.java:461) ~[?:?]
at sun.nio.ch.Net.bind(Net.java:453) ~[?:?]
at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:222) ~[?:?]
at io.netty.channel.socket.nio.NioServerSocketChannel.doBind(NioServerSocketChannel.java:128) ~[?:?]
at io.netty.channel.AbstractChannel$AbstractUnsafe.bind(AbstractChannel.java:558) ~[?:?]
at io.netty.channel.DefaultChannelPipeline$HeadContext.bind(DefaultChannelPipeline.java:1283) ~[?:?]
at io.netty.channel.AbstractChannelHandlerContext.invokeBind(AbstractChannelHandlerContext.java:501) ~[?:?]
at io.netty.channel.AbstractChannelHandlerContext.bind(AbstractChannelHandlerContext.java:486) ~[?:?]
at io.netty.channel.DefaultChannelPipeline.bind(DefaultChannelPipeline.java:989) ~[?:?]
at io.netty.channel.AbstractChannel.bind(AbstractChannel.java:254) ~[?:?]
at io.netty.bootstrap.AbstractBootstrap$2.run(AbstractBootstrap.java:365) ~[?:?]
at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163) ~[?:?]
at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:403) ~[?:?]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:463) ~[?:?]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) ~[?:?]
at java.lang.Thread.run(Thread.java:750) [?:1.8.0_412]
[2025-02-04T09:01:23,027][INFO ][o.e.n.Node ] [k3NhRcs] stopping ...
[2025-02-04T09:01:23,030][INFO ][o.e.n.Node ] [k3NhRcs] stopped
[2025-02-04T09:01:23,030][INFO ][o.e.n.Node ] [k3NhRcs] closing ...
[2025-02-04T09:01:23,040][INFO ][o.e.n.Node ] [k3NhRcs] closed
[root@lockout ~]#
Hello,
tail -n 100 /var/log/elasticsearch/elasticsearch.log
ran the relevant command and posted it above.
er, whats in your elasticsearch.yml file?
That means elasticsearch started, found an error whole bootstrapping itself, and exited.
So logstash would not have had a chance to ingest data into elasticsearch while the configuration is as it is now.
Hello,
Elasticsearch.yml looks like this,
# cat /etc/elasticsearch/elasticsearch.yml
cluster.name: elastic-cluster
node.name: lockout-node
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.port: 9200
discovery.type: single-node
xpack.security.enabled: false
logger.level: DEBUG
What is your suggestion here? How can I establish communication between them?
Hello,
Event 6.4.2, how should I proceed?
# curl -X GET "http://localhost:9200"
{
"name" : "lockout-node",
"cluster_name" : "elastic-cluster",
"cluster_uuid" : "G5U4HvD1Rz2fkntOOhCFiw",
"version" : {
"number" : "6.4.2",
"build_flavor" : "default",
"build_type" : "rpm",
"build_hash" : "04711c2",
"build_date" : "2018-09-26T13:34:09.098244Z",
"build_snapshot" : false,
"lucene_version" : "7.4.0",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
}
can we take a step back.
org.elasticsearch.transport.BindTransportException: Failed to bind to [9300-9400] and then exited - I guess you fixed that?when I want to create a new index, it continues as in the screenshot but cannot reach the result
/etc/logstash/logstash.yml
Such cases under this directory
# Settings file in YAML
#
# Settings can be specified either in hierarchical form, e.g.:
#
# pipeline:
# batch:
# size: 125
# delay: 5
#
# Or as flat keys:
#
# pipeline.batch.size: 125
# pipeline.batch.delay: 5
#
# ------------ Node identity ------------
#
# Use a descriptive name for the node:
#
# node.name: test
#
# If omitted the node name will default to the machine's host name
#
# ------------ Data path ------------------
#
# Which directory should be used by logstash and its plugins
# for any persistent needs. Defaults to LOGSTASH_HOME/data
#
path.data: /var/lib/logstash
#
# ------------ Pipeline Settings --------------
#
# The ID of the pipeline.
#
# pipeline.id: main
#
# Set the number of workers that will, in parallel, execute the filters+outputs
# stage of the pipeline.
#
# This defaults to the number of the host's CPU cores.
#
# pipeline.workers: 2
#
# How many events to retrieve from inputs before sending to filters+workers
#
# pipeline.batch.size: 125
#
# How long to wait in milliseconds while polling for the next event
# before dispatching an undersized batch to filters+outputs
#
# pipeline.batch.delay: 50
#
# Force Logstash to exit during shutdown even if there are still inflight
# events in memory. By default, logstash will refuse to quit until all
# received events have been pushed to the outputs.
#
# WARNING: enabling this can lead to data loss during shutdown
#
# pipeline.unsafe_shutdown: false
#
# ------------ Pipeline Configuration Settings --------------
#
# Where to fetch the pipeline configuration for the main pipeline
#
# path.config:
#
# Pipeline configuration string for the main pipeline
#
# config.string:
#
# At startup, test if the configuration is valid and exit (dry run)
#
# config.test_and_exit: false
#
# Periodically check if the configuration has changed and reload the pipeline
# This can also be triggered manually through the SIGHUP signal
#
# config.reload.automatic: false
#
# How often to check if the pipeline configuration has changed (in seconds)
#
# config.reload.interval: 3s
#
# Show fully compiled configuration as debug log message
# NOTE: --log.level must be 'debug'
#
# config.debug: false
#
# When enabled, process escaped characters such as \n and \" in strings in the
# pipeline configuration files.
#
# config.support_escapes: false
#
# ------------ Module Settings ---------------
# Define modules here. Modules definitions must be defined as an array.
# The simple way to see this is to prepend each `name` with a `-`, and keep
# all associated variables under the `name` they are associated with, and
# above the next, like this:
#
# modules:
# - name: MODULE_NAME
# var.PLUGINTYPE1.PLUGINNAME1.KEY1: VALUE
# var.PLUGINTYPE1.PLUGINNAME1.KEY2: VALUE
# var.PLUGINTYPE2.PLUGINNAME1.KEY1: VALUE
# var.PLUGINTYPE3.PLUGINNAME3.KEY1: VALUE
#
# Module variable names must be in the format of
#
# var.PLUGIN_TYPE.PLUGIN_NAME.KEY
#
# modules:
#
# ------------ Cloud Settings ---------------
# Define Elastic Cloud settings here.
# Format of cloud.id is a base64 value e.g. dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRub3RhcmVhbCRpZGVudGlmaWVy
# and it may have an label prefix e.g. staging:dXMtZ...
# This will overwrite 'var.elasticsearch.hosts' and 'var.kibana.host'
# cloud.id: <identifier>
#
# Format of cloud.auth is: <user>:<pass>
# This is optional
# If supplied this will overwrite 'var.elasticsearch.username' and 'var.elasticsearch.password'
# If supplied this will overwrite 'var.kibana.username' and 'var.kibana.password'
# cloud.auth: elastic:<password>
#
# ------------ Queuing Settings --------------
#
# Internal queuing model, "memory" for legacy in-memory based queuing and
# "persisted" for disk-based acked queueing. Defaults is memory
#
# queue.type: memory
#
# If using queue.type: persisted, the directory path where the data files will be stored.
# Default is path.data/queue
#
# path.queue:
#
# If using queue.type: persisted, the page data files size. The queue data consists of
# append-only data files separated into pages. Default is 64mb
#
# queue.page_capacity: 64mb
#
# If using queue.type: persisted, the maximum number of unread events in the queue.
# Default is 0 (unlimited)
#
# queue.max_events: 0
#
# If using queue.type: persisted, the total capacity of the queue in number of bytes.
# If you would like more unacked events to be buffered in Logstash, you can increase the
# capacity using this setting. Please make sure your disk drive has capacity greater than
# the size specified here. If both max_bytes and max_events are specified, Logstash will pick
# whichever criteria is reached first
# Default is 1024mb or 1gb
#
# queue.max_bytes: 1024mb
#
# If using queue.type: persisted, the maximum number of acked events before forcing a checkpoint
# Default is 1024, 0 for unlimited
#
# queue.checkpoint.acks: 1024
#
# If using queue.type: persisted, the maximum number of written events before forcing a checkpoint
# Default is 1024, 0 for unlimited
#
# queue.checkpoint.writes: 1024
#
# If using queue.type: persisted, the interval in milliseconds when a checkpoint is forced on the head page
# Default is 1000, 0 for no periodic checkpoint.
#
# queue.checkpoint.interval: 1000
#
# ------------ Dead-Letter Queue Settings --------------
# Flag to turn on dead-letter queue.
#
# dead_letter_queue.enable: false
# If using dead_letter_queue.enable: true, the maximum size of each dead letter queue. Entries
# will be dropped if they would increase the size of the dead letter queue beyond this setting.
# Default is 1024mb
# dead_letter_queue.max_bytes: 1024mb
# If using dead_letter_queue.enable: true, the directory path where the data files will be stored.
# Default is path.data/dead_letter_queue
#
# path.dead_letter_queue:
#
# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
# http.host: "127.0.0.1"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
# http.port: 9600-9700
#
# ------------ Debugging Settings --------------
#
# Options for log.level:
# * fatal
# * error
# * warn
# * info (default)
# * debug
# * trace
#
# log.level: info
path.logs: /var/log/logstash
#
# ------------ Other Settings --------------
#
# Where to find custom plugins
# path.plugins: []
#
# ------------ X-Pack Settings (not applicable for OSS build)--------------
#
# X-Pack Monitoring
# https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html
#xpack.monitoring.enabled: false
#xpack.monitoring.elasticsearch.username: logstash_system
#xpack.monitoring.elasticsearch.password: password
#xpack.monitoring.elasticsearch.url: ["https://es1:9200", "https://es2:9200"]
#xpack.monitoring.elasticsearch.ssl.ca: [ "/path/to/ca.crt" ]
#xpack.monitoring.elasticsearch.ssl.truststore.path: path/to/file
#xpack.monitoring.elasticsearch.ssl.truststore.password: password
#xpack.monitoring.elasticsearch.ssl.keystore.path: /path/to/file
#xpack.monitoring.elasticsearch.ssl.keystore.password: password
#xpack.monitoring.elasticsearch.ssl.verification_mode: certificate
#xpack.monitoring.elasticsearch.sniffing: false
#xpack.monitoring.collection.interval: 10s
#xpack.monitoring.collection.pipeline.details.enabled: true
#
# X-Pack Management
# https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html
#xpack.management.enabled: false
#xpack.management.pipeline.id: ["main", "apache_logs"]
#xpack.management.elasticsearch.username: logstash_admin_user
#xpack.management.elasticsearch.password: password
#xpack.management.elasticsearch.url: ["https://es1:9200", "https://es2:9200"]
#xpack.management.elasticsearch.ssl.ca: [ "/path/to/ca.crt" ]
#xpack.management.elasticsearch.ssl.truststore.path: /path/to/file
#xpack.management.elasticsearch.ssl.truststore.password: password
#xpack.management.elasticsearch.ssl.keystore.path: /path/to/file
#xpack.management.elasticsearch.ssl.keystore.password: password
#xpack.management.elasticsearch.ssl.verification_mode: certificate
#xpack.management.elasticsearch.sniffing: false
#xpack.management.logstash.poll_interval: 5s
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.