I'm new to Elasticsearch and configured 7 version running on CentOS 7. Trying to configure windows server to send event logs to ESS server but I'm not able to see any events under winlogbeat index pattern.
hi @nkrshna, can you check the winlogbeat logs and the elasticsearch logs, they will most likely tell you more on the reason. If there is no relevant info in the logs can you enable the debug level and retry.
Hi @MarianaD i have gone through once again on winlogbeat configuration and i see that error when executed below code in windows systems as administrator in powershell.
PS C:\Program Files\Winlogbeat> .\winlogbeat.exe setup --index-management -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]'
Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at http://localhost:9200: Get http://localhost:9200: dial tcp [::1]:9200: connectex: No connection could be made because the target machine actively refused it.]
PS C:\Program Files\Winlogbeat> .\winlogbeat.exe setup --index-management -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["Elasticsearch_IP:9200"]'
Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at http://Elasticsearch_IP:9200: Get http://Elasticsearch_IP:9200: dial tcp Elasticsearch_IP:9200: connectex: No connection could be made because the target machine actively refused it.]
After setting network.host: 0.0.0.0 in elasticsearch.yml file and restarting elasticsearch service issue got resolved and Windows events are reflecting in the portal.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.