Hi Team,
we recently encounter strange WARN messages from Logstash since we're using 7.3.0
[2019-12-04T08:46:18,174][WARN ][org.apache.kafka.clients.NetworkClient] [Consumer clientId=logstash-0, groupId=logstash] Connection to node -1 (localhost/127.0.0.1:39092) could not be established. Broker may not be available.
[2019-12-04T08:46:19,077][WARN ][org.apache.kafka.clients.NetworkClient] [Consumer clientId=logstash-0, groupId=logstash] Connection to node -1 (localhost/127.0.0.1:39092) could not be established. Broker may not be available.
[2019-12-04T08:46:20,085][WARN ][org.apache.kafka.clients.NetworkClient] [Consumer clientId=logstash-0, groupId=logstash] Connection to node -1 (localhost/127.0.0.1:39092) could not be established. Broker may not be available.
[2019-12-04T08:46:21,088][WARN ][org.apache.kafka.clients.NetworkClient] [Consumer clientId=logstash-0, groupId=logstash] Connection to node -1 (localhost/127.0.0.1:39092) could not be established. Broker may not be available.
I've tried to setup an arcsight module pipeline through the commandline, but somehow it didn't overwrite the YAML and throw the warnings. I've then wrote it directly into the YAML, but nothing changes.
Since those are warnings the pipeline is working, but I never setup the module for EventBroker, just for SmartConnector. Those Kafka behaviours must have something to do with the EventBroker in the background (because EventBroker is Kafka-based). It even uses localhost to connect to, but I have not set localhost on my elasticsearch node.
I guess there is some background function working, which I don't see/find and not get overwritten by the module entry in the YAML.
Hope the problem is comprehensibly
Best regards
Marco