從 packetbeat 安全地連接到開放發行版彈性

Question

我可以使用 curl 連接到彈性服務器，如下所示。

# curl --user "root:xxxxx"  https://search-testme-gvzxezayzzc4pcw2xcyvndb6jq.us-east-1.es.amazonaws.com/_aliases

我得到了預期的響應，這意味着憑據是正確的。

{".kibana_3506402_root":{"aliases":{}},".opendistro_security":{"aliases":{}},".kibana_1":{"aliases":{".kibana":{}}}}

但是相同的憑據在 packetbeat 中不起作用

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["search-testme-gvzxezayzzc4pcw2xcyvndb6jq.us-east-1.es.amazonaws.com:80"]

  # Optional protocol and basic auth credentials.
  protocol: "https"
  username: "root"
  password: "xxxxx"

根據日志，即使配置文件中提到了端口 80，它也會嘗試連接端口 9200。

# tail /var/log/packetbeat/packetbeat

2020-03-01T13:56:03.234Z        ERROR   pipeline/output.go:100  Failed to connect to backoff(elasticsearch(https://search-testme-gvzxezayzzc4pcw2xcyvndb6jq.us-east-1.es.amazonaws.com:9200)): Get https://search-testme-gvzxezayzzc4pcw2xcyvndb6jq.us-east-1.es.amazonaws.com:9200: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
2020-03-01T13:56:03.234Z        INFO    pipeline/output.go:93   Attempting to reconnect to backoff(elasticsearch(https://search-testme-gvzxezayzzc4pcw2xcyvndb6jq.us-east-1.es.amazonaws.com:9200)) with 10 reconnect attempt(s)

如何使用開放發行版通過 packetbeat 連接到 AWS elastic？ 如果我使用 AWS 托管的彈性雲，類似的配置工作沒有任何問題。

Answer 1

有2個要點要記住：

1）您需要 packetbeat 的“oss”（開源版本）才能工作。

2）連接到443端口

詳細說明可以在這里找到...

http://oksoft.blogspot.com/2020/03/packetbeat-to-elastic-server-hosted-by.html