Error during metricbeat or filebeat setup

#1

Hi all!
I have a big problem when I try to setup filebeat or metricbeat…

I recieve this message:
Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch https://localhost:9200: Connection marked as failed because the onConnect callback failed: cannot retrieve the elasticsearch license: error from server, response code: 500]

In the elasticsearch logs I found this:

[2019-05-08T17:00:33,129][ERROR][c.a.o.s.f.OpenDistroSecurityFilter] [EV--xse] Unexpected exception [_xpack] InvalidIndexNameException[Invalid index name [_xpack], must not start with '_'.]
org.elasticsearch.indices.InvalidIndexNameException: Invalid index name [_xpack], must not start with '_'.

Could anyone help me please?

#2

Hiya -

Are you using the OSS versions of the Beats agents (not the commercial ones)? They recently added a license check that makes the default downloaded beats agents non-compatible with the OSS version of Elasticsearch.

For metricbeat - you want this one: https://www.elastic.co/downloads/past-releases/metricbeat-oss-6-7-2

Same for filebeat: https://www.elastic.co/downloads/past-releases/filebeat-oss-6-7-2

Not positive if that is your issue but it is likely given the error.

#3

Thanks a lot carlmead!!
Unfortunately this solution doesn’t work…

After the filebeat-oss setup I have launched these commands:

sudo filebeat modules enable elasticsearch
sudo filebeat setup

and this is the output:

xxx@ip:~$ sudo filebeat setup
Loaded index template
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards

Exiting: 2 errors: Error checking if xpack is available: 500 Internal Server Error:

{
  "error": {
    "root_cause": [
      {
        "type": "security_exception",
        "reason": "Unexpected exception indices:admin/get"
      }
    ],
    "type": "security_exception",
    "reason": "Unexpected exception indices:admin/get"
  },
  "status": 500
}

And in the elasticsearch logs:

[2019-05-09T08:01:21,378][ERROR][c.a.o.s.f.OpenDistroSecurityFilter] [EV--xse] Unexpected exception [_xpack] InvalidIndexNameException[Invalid index name [_xpack], must not start with '_'.]
org.elasticsearch.indices.InvalidIndexNameException: Invalid index name [_xpack], must not start with '_'.

This is really curious …

#4

I solved with OSS installations and this link Filebeat connection issue

and filebeat startup command is: sudo filebeat setup -e --dashboards --pipelines --template

thanks

1 Like