This group has always been helpful and hopefully they can help me again.
We created a new cluster and installed 8.6
We have a 3 nodes cluster for Elasticsearch, 2 Logstash and 2 Kibana.
We completed the configuring in our Elastic cluster and in our kibana. We did a curl and see our 3 ES nodes have the same cluster UUID and it shows as healthy.
We installed Logasth and we installed metricbeat. We don't have metricbeat installed anywhere else yet.
We followed the instructions here:
Our problem is when we run
metricbeat test modules
we get the result:
logstash...
node...
error... ERROR timeout waiting for an event
node_stats...
error... ERROR timeout waiting for an event.
We don't know if this may have something to do but when we enabled xpack.management.enable: true
We get:
[logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"No Available connections"}
But when we do
metricbeat test output
Everything looks good and ok.
Here is the configuration (elasticsearch.yml) of one of my elasticsearch nodes:
cluster.name: main-cluster
node.name: node-01.mydomain.com
path.data: /data
path.logs: /var/log/elasticsearch/
bootstrap.memory_lock: true
network.host: 192.168.0.98
http.port: 9200
discovery.seed_hosts: ["https://node-1.mydomain.com:9200", "https://node-2.mydomain.com:9200", "https://node-3.mydomain.com:9200"]
cluster.initial_master_nodes: ["https://node-1.mydomain.com:9200", "https://node-2.mydomain.com:9200", "https://node-3.mydomain.com:9200"]
# security settings
xpack.security.enabled: true
xpack.security.autoconfiguration.enabled: false
xpack.security.enrollment.enabled: true
# transport ssl
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.key: certs/node-1.key
xpack.security.transport.ssl.certificate: certs/node-1.crt
xpack.security.transport.ssl.certificate_authorities: certs/ca.crt
## http ssl
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: certs/node-01.key
xpack.security.http.ssl.certificate: certs/node-1.crt
xpack.security.http.ssl.certificate_authorities: certs/ca.crt
My logstah.yml file looks like this:
node.name: logstash-01.mydomain.com
path.data: /var/lib/logstash
api.enabled: true
api.http.host: "logstash-01.mydomain.com"
api.http.port: 9600-9700
api.ssl.enabled: true
api.ssl.keystore.path: /etc/certs/keystore.jks
api.ssl.keystore.password: "password"
config.reload.automatic: true
config.reload.interval: 3s
log.level: debug
path.logs: /var/log/logstash
xpack.management.enabled: true
#xpack.management.pipeline.id: ["main", "apache_logs"]
xpack.management.Elasticsearch.username: elastic
xpack.management.Elasticsearch.password: password
xpack.management.Elasticsearch.hosts: ["https://node-1.mydomain.com:9200", "https://node-2.mydomain.com:9200", "https://node-3.mydomain.com:9200"]
xpack.management.Elasticsearch.ssl.certificate_authority: [ "/etc/certs/ca.crt" ]
xpack.management.Elasticsearch.ssl.keystore.path: /etc/certs/logstash.jks
xpack.management.Elasticsearch.ssl.keystore.password: password
xpack.management.Elasticsearch.ssl.verification_mode: certificate
xpack.management.Elasticsearch.sniffing: false
xpack.management.logstash.poll_interval: 5s
my metricbeat.yml file
#============================ Config Reloading ===============================
metricbeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.period: 10s
reload.enabled: true
#======================Elasticsearch Template settings#=========================*
setup.template.settings:
index.number_of_shards: 1
index.codec: best_compression
#===============================Kibana==================================*
setup.kibana:
host: ["http://kiba-01:5601","http://kiba-02:5601"]
ssl.verification_mode: "none"
#=======================Elasticsearch Output==================================
output.elasticsearch:
hosts: ["https://node-1.mydomain.com:9200", "https://node-2.mydomain.com:9200", "https://node-3.mydomain.com:9200"]
protocol: "https"
username: "elastic"
password: "password"
ssl.verification_mode: "none"
#=============================Processors===============================
processors:
-add_host_metadata: ~
#=============================Logging======
# You had this incorrect logging.level=debug
logging.level: debug
#=============================X-Pack Monitoring==============================
# This self enables monitoring of this beat so you don't need the beats-xpack
monitoring.enabled: true
We enabled the logstash-xpack module
# Module: logstash
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.17/metricbeat-module-logstash.html
- module: logstash
xpack.enabled: true
period: 10s
hosts: ["logstash-01.mydomain.com:9600"]
username: "elastic"
password: "pass"
ssl.verification_mode: "none"