Tomcat HTTP requests are not showing by PACKETBEAT

Elastic Stack Beats
1

Not loop traffic http request origined by Tomcat server 8.5.30 only view on destination server.

packetbeat.interfaces.device: any

packetbeat.flows:
timeout: 30s
period: 10s

packetbeat.protocols.dns:
ports: [53]
include_authorities: true
include_additionals: true

packetbeat.protocols.http:
ports: [22080, 22880, 9080, 9060]
send_request: true
send_response: true
real_ip_header: "X-Forwarded-For"

packetbeat.protocols.memcache:
ports: [11211]

packetbeat.protocols.mysql:
ports: [3306]

packetbeat.protocols.pgsql:
ports: [5432]

packetbeat.protocols.redis:
ports: [6379]

packetbeat.protocols.thrift:
ports: [9090]

packetbeat.protocols.mongodb:
ports: [27017]

packetbeat.protocols.cassandra:
ports: [9042]

processors:

  • add_cloud_metadata:

output.elasticsearch:
hosts: ['elasticsearch:9200']
username: elastic
password: changeme

2

Are you running packetbeat and tomcat on Windows? There is a known issue capturing loopback traffic in Windows, see about this limitation here: https://www.elastic.co/guide/en/beats/packetbeat/current/faq.html#packetbeat-loopback-interface

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.