将 filebeat 连接到 Kibana

Question

I'm trying to setup filebeat on a server and then run the setup on a Elastic Stack Docker container setup. But currently whatever I try there is no option to get it working. With or without https I'm getting the following error:

2019-03-05T14:58:20.458+0100    ERROR   instance/beat.go:911    Exiting: Failed to import index-pattern: Failed to load directory /usr/share/filebeat/kibana/6/index-pattern:
          error loading /usr/share/filebeat/kibana/6/index-pattern/filebeat.json: fail to execute the HTTP POST request: Post http://10.248.115.125:5601/api/kibana/dashboards/import?force=true: net/http: request canceled (Client.Timeout exceeded while awaiting headers). Response:
        Exiting: Failed to import index-pattern: Failed to load directory /usr/share/filebeat/kibana/6/index-pattern:
          error loading /usr/share/filebeat/kibana/6/index-pattern/filebeat.json: fail to execute the HTTP POST request: Post http://10.248.115.125:5601/api/kibana/dashboards/import?force=true: net/http: request canceled (Client.Timeout exceeded while awaiting headers). Response:

firebeat.yml is configured as:

# List of inputs to fetch data.
filebeat.inputs:
- type: log

  paths:
    - "/var/log/nova/*.log"
  document_type: nova

  paths:
    - "/var/log/neutron/*.log"
  document_type: neutron

  paths:
    - "/var/log/messages"
  document_type: syslog

  paths:
    - "/var/log/openvswitch/*.log"
  document_type: openvswitch

  paths:
    - "/var/log/ceilometer/*.log"
  document_type: ceilometer

  paths:
    - "/var/log/libvirt/*.log"
  document_type: libvirt

  # Change to true to enable this input configuration.
  enabled: true

output.elasticsearch:
  hosts: '10.000.000.000:9200'

  # Optional SSL settings
  #ssl.enabled: true
  #ssl.verification_mode: "none"

  protocol: "http"
  #username: "elastic"
  #password: "Nd6nFv8ktCbZMqKgiLsFgQ=="

  #template.name: "filebeat"
  #template.path: "filebeat.template.json"

setup.kibana:
  host: "http://10.000.000.000:5601"
  #username: "elastic"
  #password: "Nd6nFv8ktCbZMqKgiLsFgQ=="
  protocol: "http"
  ssl.enabled: false

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

Kibana is running with Elasticsearch and logstash on on other host in Docker containers.

Answer 1

I suppose when you change kibana.host as described in the documentation , you will be able to create dashboard:

setup.kibana:
  host: "10.0.0.0:5601"
  protocol: "http"
  ssl.enabled: false

Answer 2

It's user authorization issue. Filebeat before loading data into ES, load Kibana dashboard and fails. Switch your security to IP whitelisting in aws or FB to Logstash and then to ES will work. Reference