Logstash doesn't receive packetbeat logs

Hello,

I have the following set up:

  • server1 is running packetbeat. In packetbeat.yml i have configure output to my logstash node.
  • server2 is running logstash and elasticsearch. There is were I want to send all my data.

I use the standard beats pipeline config that's listen on 5044.
When I do curl http://www.elastic.co/ on server one, I should see this on server 2. I check this with curl -XGET 'http://localhost:9200/packetbeat-*/_search?pretty' but see anything ....

Do I miss something? How can I troubleshoot this?

Robin

Can you repeat the test running Packetbeat with debug enabled (-d '*') and share the output ?

With commando: curl -XGET 'http://localhost:9200/packetbeat-/_search?pretty' -d ''
I get this output:
"error" : "Content-Type header [application/x-www-form-urlencoded] is not supported",
"status" : 406

In the meantime, I see that the service failed. Here are the logs from the services:

apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Service hold-off time over, scheduling restart.
apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Scheduled restart job, restart counter is at 5.
apr 05 00:58:09 server01 systemd[1]: Stopped Packetbeat analyzes network traffic and sends the data to Elasticsearch..
apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Start request repeated too quickly.
apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Failed with result 'exit-code'.
apr 05 00:58:09 server01 systemd[1]: Failed to start Packetbeat analyzes network traffic and sends the data to Elasticsearch..
-- Reboot --
apr 05 01:36:12 server01 systemd[1]: Started Packetbeat analyzes network traffic and sends the data to Elasticsearch..
apr 05 01:36:14 server01 packetbeat[759]: Exiting: error loading config file: config file ("/etc/packetbeat/packetbeat.yml") can only be writable by the owner but the permission
apr 05 01:36:14 server01 systemd[1]: packetbeat.service: Main process exited, code=exited, status=1/FAILURE
apr 05 01:36:14 server01 systemd[1]: packetbeat.service: Failed with result 'exit-code'.
apr 05 01:36:15 server01 systemd[1]: packetbeat.service: Service hold-off time over, scheduling restart.

It's staying in this loop.
Hope you know something

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.