Filebeat connection issue

Hi,
I am getting below error with file beat setup
sudo filebeat setup gives

“Exiting: 1 error: Error checking if xpack is available: 500 Internal Server Error: {“error”:{“root_cause”:[{“type”:“security_exception”,“reason”:“Unexpected exception indices:admin/get”}],“type”:“security_exception”,“reason”:“Unexpected exception indices:admin/get”},“status”:500}”
appreciate if someone can assist

filebeat.yml has this set but its not helping
xpack.monitoring.enabled: false

Elastic Search and Kibana are running but i need to send events using filebeat to ES and display in Kibana.
appreciate if someone can assist

Thanks,
KK

Can you share your filebeat.yml file?

Looks like you are not using the OSS version of Beats which does not have the X-Pack flags. They recently added checks that will not allow the commercially licensed agents/clients communicate with OSS versions of Elasticsearch. I suspect a lot of folks will run into this one.

Make sure you are using this download: https://www.elastic.co/downloads/beats/filebeat-oss
Not this download: https://www.elastic.co/downloads/beats/filebeat

hi,
Thanks for the reply i am now using filebeat-oss-7.0.0-x86_64.rpm when i do
sudo filebeat setup i still get an error which is

Blockquote
Exiting: 3 errors: Error checking if xpack is available: 500 Internal Server Error: {“error”:{“root_cause”:[{“type”:“security_exception”,“reason”:“Unexpected exception indices:admin/get”}],“type”:“security_exception”,“reason”:“Unexpected exception indices:admin/get”},“status”:500}; Error checking if xpack is available: 500 Internal Server Error: {“error”:{“root_cause”:[{“type”:“security_exception”,“reason”:“Unexpected exception indices:admin/get”}],“type”:“security_exception”,“reason”:“Unexpected exception indices:admin/get”},“status”:500}; Error checking if xpack is available: 500 Internal Server Error: {“error”:{“root_cause”:[{“type”:“security_exception”,“reason”:“Unexpected exception indices:admin/get”}],“type”:“security_exception”,“reason”:“Unexpected exception indices:admin/get”},“status”:500}

so its still not working not sure why
appreciate your help, someone should have got this working for sure so its a puzzle this is not working.
:thinking:

finally this helped
sudo filebeat setup -e --dashboards --pipelines --template

its working
I have just started a long way to go :smile: but thanks heaps for your help @carlmead otherwise i would have been stuck for ages :slight_smile:

2 Likes

Can anyone share their filebeat configuration please?