MetricBeat error

Elastic Stack Beats
1

Ok will try to be civil here, but 'd be hard as Im furious. Have spent all f* day tryting to setup Kibana ( cloud / self )

Am trying to configure metricbeat using this.
Im getting

Screenshot 2021-01-25 at 18.48.25
Screenshot 2021-01-25 at 18.48.251392×912 61.6 KB

Anyone?

PS: why all texts here are so huge? Does author think that people are blind or what?

2

Hi @cloudenv,

thank you for striving for civility. The links you included in your question are private, though, so we'll have to rely on text and screenshots for illustration.

Regarding your metricbeat error, the message suggests there's a syntax error in the yaml file. Did you modify the main config file or any module's config file?

3

@weltenwort thank you for your answer. Im sorry for private links.
No I did not modify any of the files mentioned by you......

4

Then maybe one of the files got corrupted for some reason. In any case, could you check the metricbeat.yml and modules.d/aws.yml for correct syntax? Or you could post them here (with credentials redacted!) so we can have a look.

5

No file is corrupted; checked their controlsums........

Now Im stuck with

Screenshot 2021-01-28 at 14.03.47
Screenshot 2021-01-28 at 14.03.471690×47 6.09 KB

This error is rather generic.

Our AM ( Architecture Manager ) said that this is fucked up ( his own words, not mine ) and made a decision to switch to another solution.

We need something that will not require spending close to week on fighting some stupid errors.
We need somerthin g that will just work; OOTB would be best.

So, bye ES. Without any regrets.

========

Now as me = my person; not employee of a company.
when I have free time ( for example in summer break ) I will be more than happy to start an instance (preferably on AWS as I have my personal account there ) and do digging what causes the above error......

=======

Dont get me wrong: ES may be great software, with lots of functionalities, but it just does not suit our needs/requirements. We cannot afford spending close to week on configuration.

6

Sorry to hear that, but I hope you find something that suits your company's requirements better.

The "connection refused" error is generic because it comes from your OS and indicates that there is no process listening for TCP connections on that ip and port (or a firewall is blocking it).

7

If - as you say - this message comes from my OS, than how come that today was very first time I saw it?

8

Sorry, I can't tell from the limited amount of information. I can just interpret the error as it is shown in the screenshot:

It tries to connect via TCP to port 9200 on the configured host and the operating system's TCP stack reports that the remote host has refused the connection by sending a packet with an RST flag during the TCP handshake. This is usually the case if no listening socket has been opened on the remote side or if a firewall is injecting the reset packet.

I could speculate that...

  • Elasticsearch is not running on that particular remote host
  • Elasticsearch is not configured to listen on the correct network interface on the remote host
  • Elasticsearch has been configured to listen to a different port from the default 9200 on the remote host
  • the remote host has a firewall in place, which blocks TCP connections to that port
  • there is a typo in the configured IP address

As to why you're seeing it for the first time: Could it be the first time you get past YAML parsing errors to realize that either of the above is the case?

I could probably come up with more underlying reasons, but that's what I would check first.

1 Like
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.