# Auditbeat + AWS Opensearch connection timeout **URL:** \ **Category:** Open Source Elasticsearch and Kibana\ **Created:** [December 16, 2021, 2:30am UTC](https://forum.opensearch.org/t/auditbeat-aws-opensearch-connection-timeout/8036 "2021-12-16T02:30:16Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![martosteve](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/martosteve/32/2551_2.png) [@martosteve](https://forum.opensearch.org/u/martosteve)\ **Post date:** [December 16, 2021, 2:30am UTC](https://forum.opensearch.org/t/auditbeat-aws-opensearch-connection-timeout/8036/1 "2021-12-16T02:30:16Z")
I am trying to connect my auditbeat agents with Opensearch on AWS. I have setup a user with the required permissions within the OS security plugin in the front end. I can connect with curl and via a browser to the endpoint from the hosts but `sudo auditbeat setup -e` just fails due to timeout. I am using the OSS version of auditbeat 7.12.1. I have tried two different hosts. ```auto curl -XGET https://endpoint--url--aws-region.es.amazonaws.com/ -u 'usernam:Password' --insecure { "name" : "9ec417c96db259a33fghiy6b1db2dgh6680", "cluster_name" : "87655688886:clustername3", "cluster_uuid" : "s-R7WFTFQ2ulebAbFVSzmQ", "version" : { "number" : "7.10.2", "build_type" : "tar", "build_hash" : "unknown", "build_date" : "2021-11-11T13:03:46.725100Z", "build_snapshot" : false, "lucene_version" : "8.8.2", "minimum_wire_compatibility_version" : "6.8.0", "minimum_index_compatibility_version" : "6.0.0-beta1" }, "tagline" : "The OpenSearch Project: https://opensearch.org/" } ``` The errors in auditbeat, it just times out, no actual reason given: ```auto ERROR [esclientleg] eslegclient/connection.go:261 error connecting to Elasticsearch at https://aws-endpoint-url.es.amazonaws.com:9200: Get "https://aws-endpoint-url.es.amazonaws.com:9200": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) ERROR instance/beat.go:971 Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at https://aws-endpoint-url.es.amazonaws.com:9200: Get "https://aws-endpoint-url.amazonaws.com:9200": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)] Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at https://aws-endpoint-url.amazonaws.com:9200: Get "https://aws-endpoint-url.es.amazonaws.com:9200": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)] ``` ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [December 16, 2021, 2:19pm UTC](https://forum.opensearch.org/t/auditbeat-aws-opensearch-connection-timeout/8036/2 "2021-12-16T14:19:53Z")
Two things: 1. Double confirm you’re using the OSS variant (it’s a tad hard to find) - I know you say you’re using it but a lot of folks accidentally download the wrong version. 2. Follow the [instructions in the docs](https://opensearch.org/docs/latest/clients/agents-and-ingestion-tools/index/) to put OpenSearch into compatibility mode. ---
**Author:** ![martosteve](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/martosteve/32/2551_2.png) [@martosteve](https://forum.opensearch.org/u/martosteve)\ **Post date:** [December 16, 2021, 10:06pm UTC](https://forum.opensearch.org/t/auditbeat-aws-opensearch-connection-timeout/8036/3 "2021-12-16T22:06:01Z")
Thanks for the reply 😀 When I configured the domain I enabled compatibility mode in AWS. It is reporting version 7.10.2. The auditbeat version I am using is definitely the OSS version 7.12.1, I made the error of using the newer version at the beginning. I may have to move away from AWS managed and just install on EC2 for now, but that defeats what I was trying to do by handing over the admin of the servers to AWS. ---
**Author:** ![martosteve](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/martosteve/32/2551_2.png) [@martosteve](https://forum.opensearch.org/u/martosteve)\ **Post date:** [December 22, 2021, 11:35pm UTC](https://forum.opensearch.org/t/auditbeat-aws-opensearch-connection-timeout/8036/4 "2021-12-22T23:35:36Z")
For the pruposes of troubleshooting I have tried creating my own Opeasearch cluster on an EC2 using docker. The error from Auditbeat now is different so this is progress. I now get the X509 certificate error. I tried disabling SSL verification but it still does not work. `ssl.verification_mode: none` Auditbeat OSS version 7.12.1 Docker Opensearch 1.2.0 ```auto sudo auditbeat setup -e ........ 2021-12-22 ERROR [esclientleg] eslegclient/connection.go:261 error connecting to Elasticsearch at https://ip.address:9200: Get "https://ip.address:9200": x509: certificate signed by unknown authority 2021-12-22 ERROR instance/beat.go:971 Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at https://ip.address:9200: Get "https://ip.address:9200": x509: certificate signed by unknown authority] Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at https://ip.address:9200: Get "https://ip.address:9200": x509: certificate signed by unknown authority] ``` ---
**Author:** ![martosteve](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/martosteve/32/2551_2.png) [@martosteve](https://forum.opensearch.org/u/martosteve)\ **Post date:** [December 29, 2021, 2:43am UTC](https://forum.opensearch.org/t/auditbeat-aws-opensearch-connection-timeout/8036/5 "2021-12-29T02:43:21Z")
Hey all - have been working on this and consulting with support. - It DOES work using the source/tar version of Auditbeat 7.12.1. Still working on the RPM version. - The dashboards cannot be automatically created using “auditbeat setup -e”. But it will create the indexes and you have to create your own dashboards. - you need to add some custom configs. Custom configs below to create the indexes and disable ILM: ```auto setup.ilm: enabled: false # ======================= Elasticsearch template setting ======================= setup.template.settings: index.number_of_shards: 1 #index.codec: best_compression #_source.enabled: false name: "auditbeat" pattern: "auditbeat-*" ``` ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [January 3, 2022, 4:12pm UTC](https://forum.opensearch.org/t/auditbeat-aws-opensearch-connection-timeout/8036/6 "2022-01-03T16:12:53Z")
Glad to see you’re making progress!