Pipeline/output.go:154 Failed to connect to backoff

Elastic Stack Beats
1

Hello,
I'm getting this error, does anyone knows how to solve this?

ERROR	[publisher_pipeline_output]	pipeline/output.go:154	Failed to connect to backoff(elasticsearch(https://xxxxxx:9200)): Connection marked as failed because the onConnect callback failed: resource 'filebeat-7.14.0' exists, but it is not an alias
2

I think this means that the index you are trying to write to exists but is not an alias as you likely defined some sort of ILM rules to be followed.

If you can paste your beats output config then that will help to figure out the problem.

3

Thanks for reply

 # ================================== Outputs ===================================

# Configure what output to use when sending the data collected by the beat.

# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["xxxxxx:9200"]

  indices:
    - index: "logindex-%{[fields.server]}-%{[fields.log_type]}-%{+yyyy.MM.dd}"
      when.contains:
        fields.log_group: "paltform"

  # Protocol - either `http` (default) or `https`.
  protocol: "https"

  # Authentication credentials - either API key or username/password.
  username: "username"
  password: "password"
4

Have you recently upgraded your agents or Elasticsearch?

Try setting this in filebeat:

setup.template.settings:
  setup.template.overwrite: true
  setup.template.enabled: true
5

No, we didn't upgrade anything, We shut down ES for a month. When we started ES it stopped working and getting this error @AquaX template setting not working

image
image1182×390 54.3 KB

6

Put

setup.template.enabled: true
setup.template.overwrite: true

before setup.template.settings:
ideally above setup.template.name

7

Getting the same error for both conditions.

image
image1182×460 59 KB

Screenshot 2021-12-02 at 8.11.52 PM
Screenshot 2021-12-02 at 8.11.52 PM1166×402 53.6 KB

8

Hmm... strange. I'm honestly not sure what the problem could be.
Does your template on Elasticsearch include an alias?

9

How to check alias?
I hope this is correct cmd.

image
image2112×940 80.8 KB

10

While checking the ES logs, I received this error.


> [ERROR][o.e.x.i.IndexLifecycleRunner] [ip] current step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}] for index [logindex-qa-xx-log-2021.10.03] with policy [10-day_delete_policy] is not recognized
11

Deleted the filebeat-7.14.0 index.
This one help me to resolved this issue
------>>

<<------

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.