从 packetbeat 安全地连接到开放发行版弹性

Question

我可以使用 curl 连接到弹性服务器，如下所示。

# curl --user "root:xxxxx"  https://search-testme-gvzxezayzzc4pcw2xcyvndb6jq.us-east-1.es.amazonaws.com/_aliases

我得到了预期的响应，这意味着凭据是正确的。

{".kibana_3506402_root":{"aliases":{}},".opendistro_security":{"aliases":{}},".kibana_1":{"aliases":{".kibana":{}}}}

但是相同的凭据在 packetbeat 中不起作用

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["search-testme-gvzxezayzzc4pcw2xcyvndb6jq.us-east-1.es.amazonaws.com:80"]

  # Optional protocol and basic auth credentials.
  protocol: "https"
  username: "root"
  password: "xxxxx"

根据日志，即使配置文件中提到了端口 80，它也会尝试连接端口 9200。

# tail /var/log/packetbeat/packetbeat

2020-03-01T13:56:03.234Z        ERROR   pipeline/output.go:100  Failed to connect to backoff(elasticsearch(https://search-testme-gvzxezayzzc4pcw2xcyvndb6jq.us-east-1.es.amazonaws.com:9200)): Get https://search-testme-gvzxezayzzc4pcw2xcyvndb6jq.us-east-1.es.amazonaws.com:9200: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
2020-03-01T13:56:03.234Z        INFO    pipeline/output.go:93   Attempting to reconnect to backoff(elasticsearch(https://search-testme-gvzxezayzzc4pcw2xcyvndb6jq.us-east-1.es.amazonaws.com:9200)) with 10 reconnect attempt(s)

如何使用开放发行版通过 packetbeat 连接到 AWS elastic？ 如果我使用 AWS 托管的弹性云，类似的配置工作没有任何问题。

Answer 1

有2个要点要记住：

1）您需要 packetbeat 的“oss”（开源版本）才能工作。

2）连接到443端口

详细说明可以在这里找到...

http://oksoft.blogspot.com/2020/03/packetbeat-to-elastic-server-hosted-by.html