Logstash doesn't receive packetbeat logs

Elastic Stack Beats
1

Hello,

I have the following set up:

  • server1 is running packetbeat. In packetbeat.yml i have configure output to my logstash node.
  • server2 is running logstash and elasticsearch. There is were I want to send all my data.

I use the standard beats pipeline config that's listen on 5044.
When I do curl http://www.elastic.co/ on server one, I should see this on server 2. I check this with curl -XGET 'http://localhost:9200/packetbeat-*/_search?pretty' but see anything ....

Do I miss something? How can I troubleshoot this?

Robin

2

Can you repeat the test running Packetbeat with debug enabled (-d '*') and share the output ?

3

With commando: curl -XGET 'http://localhost:9200/packetbeat-/_search?pretty' -d ''
I get this output:
"error" : "Content-Type header [application/x-www-form-urlencoded] is not supported",
"status" : 406

In the meantime, I see that the service failed. Here are the logs from the services:

apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Service hold-off time over, scheduling restart.
apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Scheduled restart job, restart counter is at 5.
apr 05 00:58:09 server01 systemd[1]: Stopped Packetbeat analyzes network traffic and sends the data to Elasticsearch..
apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Start request repeated too quickly.
apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Failed with result 'exit-code'.
apr 05 00:58:09 server01 systemd[1]: Failed to start Packetbeat analyzes network traffic and sends the data to Elasticsearch..
-- Reboot --
apr 05 01:36:12 server01 systemd[1]: Started Packetbeat analyzes network traffic and sends the data to Elasticsearch..
apr 05 01:36:14 server01 packetbeat[759]: Exiting: error loading config file: config file ("/etc/packetbeat/packetbeat.yml") can only be writable by the owner but the permission
apr 05 01:36:14 server01 systemd[1]: packetbeat.service: Main process exited, code=exited, status=1/FAILURE
apr 05 01:36:14 server01 systemd[1]: packetbeat.service: Failed with result 'exit-code'.
apr 05 01:36:15 server01 systemd[1]: packetbeat.service: Service hold-off time over, scheduling restart.

It's staying in this loop.
Hope you know something