Metricbeat stops logstash monitoring

[tennaen (Norbert Grzebieniarz)]

I have running metricbeat, to monitor my ELK. It works great for Kibana and Elasticsearch, but when it comes to Logstash, it stops showing status. Starts working only after metricbeat restart.
Logstash version: 7.5.2
Metricbeat version: 7.5.2
Metricbeat logstash-xpack.yml

# Module: logstash
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.5/metricbeat-module-logstash.html

- module: logstash
  metricsets:
    - node
    - node_stats
  period: 60s
  hosts: ["my_ip:9600"]
  username: "monitor"
  password: "${monitor.password}"
  xpack.enabled: true

logstash.yml

node.name: node_name
path.data: /u01/app/logstash/data
http.host: my_ip
http.port: 9600
log.level: info
path.logs: /u01/data/ls_logs
config.reload.automatic: true
xpack.monitoring.enabled: false

Metricbeat logs show this message:

2020-02-13T08:39:36.801+0100 ERROR [logstash.node_stats] node_stats/node_stats.go:81 HTTP error 400 in : 400 Bad Request

[maxh1]

We have the exact same problem here, on the same version (7.5.2).

Everything works fine for a while (after restarting Metricbeat), but then the dataflow stops, and we see the same error as OP in the logs:

2020-02-14T03:14:09.685+0100 ERROR [logstash.node_stats] node_stats/node_stats.go:81 HTTP error 400 in : 400 Bad Request

No errors can be seen on the Logstash side, that would explain why the HTTP API server is throwing back a 400 Bad Request.

Any suggestions?

[praveenmak]

I have the same error , MB stops after node_stats fails.

[shaunak (Shaunak Kashyap)]

I think you might be running into this bug: https://github.com/elastic/beats/issues/15974. It was fixed via https://github.com/elastic/beats/pull/16044 and the fix is released in version 7.6.0.

Hope that helps,

Shaunak

[tennaen (Norbert Grzebieniarz)]

@shaunak metricbeat updated to 7.6. Now i can just wait.

[tennaen (Norbert Grzebieniarz)]

It's working now. Thanks!

[praveenmak]

Yes, its working now. Thanks!