Standalone cluster using new parameter beat-xpack in metricbeat

Elastic Stack Beats
,
1

Hello,

I have multiple filebeat on several cluster. The monitoring is done by using beat-xpack feature from metricbeat on another server, using the HTTP entry point on each filebeat.

However, Metricbeat ( with a correct elasticsearch output) always creates a standalone cluster.

How can i force the cluster_uuid ? I tried to set parameter "override_cluster_uuid" in filebeat configuration file, but this parameter is only avalaible when the filebeat directly sends monitoring stats to elasticsearch and that's obvioulsly not what i want.

I only need my metricbeat (using beat_xpack) to connect to filebeat Entry point and send metrics to an elasticsearch using the right cluster_uuid

any idea ?

Thanks,

2

Try using monitoring.cluster_uuid:

3

i already tried this parameter in metricbeat.yml, but this has no effect

4

Hi @Christophe_Journel,

What versions of Filebeat and Metricbeat are you running?

Could you share your filebeat.yml, metricbeat.yml and modules.d/beat-xpack.yml from Metricbeat? Please mask any sensitive information in these files before posting.

Thanks,

Shaunak

5

Hello @shaunak

metricbeat version :metricbeat-7.4.0-1.x86_64
filebeat version: filebeat-7.4.1-1.x86_64

And here is the filebeat configuration file (i deleted all unnecessary information and replaced IP addresses etc.)

 ######################## Filebeat Configuration ############################
 
 #=========================== Filebeat inputs =============================
 
 # List of inputs to fetch data.
 filebeat.inputs:
rpm
 
   path: "/tmp/filebeat"
   filename: filebeat
   rotate_every_kb: 10000
   number_of_files: 2
   permissions: 0600
 
 #================================ Logging ======================================
 logging.level: info
 
 logging.to_files: true
 logging.files:
   path: /var/log/filebeat
   name: filebeat
   rotateeverybytes: 10485760 # = 10MB
   keepfiles: 7
   permissions: 0644
   #interval: 0
 #================================ HTTP Endpoint 
 http.enabled: true
 http.host: 10.10.10.10
 http.port: 5066

and here is the metricbeat.yml file

 ###################### Metricbeat Configuration Example ######################
 #==========================  Modules configuration ============================
 
 metricbeat.config.modules:
   # Glob pattern for configuration loading
   path: ${path.config}/modules.d/*.yml
 
   # Set to true to enable config reloading
   reload.enabled: false
 
   # Period on which files under path should be checked for changes
   #reload.period: 10s
 
 #==================== Elasticsearch template setting ==========================
 
 setup.template.settings:
   index.number_of_shards: 1
   index.codec: best_compression
   #_source.enabled: false
 
 #================================ General =====================================
 
 #-------------------------- Elasticsearch output ------------------------------
 output.elasticsearch:
   # Array of hosts to connect to.
   hosts: ["myES1:9200","myES2:9200"]
 
   # Optional protocol and basic auth credentials.
   #protocol: "https"
   username: "elastic"
   password: "XXXXXXXXXXX"
 
 #================================ Processors ====================================
 
 # Configure processors to enhance or manipulate events generated by the beat.
 
 processors:
   - add_host_metadata: ~
   - add_cloud_metadata: ~
 
 monitoring.enable: true
 setup.ilm.enabled: false
 monitoring.cluster_uuid: XXXXXXXXXX

The file /etc/metricbeat/modules.d/beat-xpack.yml looks like this:

# Module: beat
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.4/metricbeat-module-beat.html

- module: beat
  metricsets:
    - stats
    - state
  period: 10s
  hosts: ["10.10.10.10" ]
  xpack.enabled: true

Thanks for your help !

6

I think you may have discovered a bug here, but I want to double check something first. In your filebeat.yml what output are you using?

Shaunak

7

Hello,

The only output used in filebeat.yml is the logstash one.
However, i tried the file output with the same result.

8

Thanks. I was able to reproduce your setup locally and this indeed looks like a bug :disappointed:. Thanks for discovering it. I have put up a PR to try and fix it: https://github.com/elastic/beats/pull/14338.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.