Non-zero metrics in the last 30s

Non-zero metrics in the last 30s: libbeat.publisher.messages_in_worker_queues=4 libbeat.publisher.published_events=61

I can not configure the packetbeat to send elasticsearch.

I can not configure the packet transmission to send elasticsearch.Kibina shows DNS queries, the search by reference

does not show the requests (more accurately it shows static 3 DNS requests although the traffic passes)
Maybe I'm using the wrong link


packetbeat.interfaces.device: 0
ports: [53]
include_authorities: true
include_additionals: true

hosts: ["localhost:9200"]

The log output clearly states events being successfully published to Elasticsearch.

Can you clearify what you're trying to do? Please share more complete configuration and logs. Use the </> button for format logs/configs.

I apologize. Indeed the data comes in elasticsearch, but I do not understand where. Where it is possible to look and what configuration and logs it is necessary to throw off? I try to understand as there is a data transmission in elasticsearch a file and in what format where it is transformed in json records and where in general it is stored

I was also confounded by this "non-zero metrics in the last 30s" message and thought packetbeat was not able to read network traffic, because I did not see indices being created in kibana. However, after a night's sleep, I realized that Kibana's Index Patterns list does not auto-discover new indices! I run ES on AWS, AWS reported packetbeat indices.

TL;DR Kibana's management GUI is not a good tool for checking if your beats are creating new indices

check out the elasticsearch docs for API to query data and indices. The API commands can also be run from kibana.

Accessing http://elasticsearch-host:9200/_cat/indices?pretty should get you a list of available indices. Check for packetbeat-* indices being available. In kibana you will have to configure an index pattern packetbeat-*, to access these data from kibana UI.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.