hello all, Seems that open distro instructions are not updated or not correct. After following the instructions for setting up Suricata module I always get the same error : Failed to connect to backoff(elasticsearch()): Connection marked as failed because the onConnect callback failed: cannot retr…

Which version of filebeat have you installed?

Looks like can be related to the non-OSS version fo the Filebeat - Filebeat connection issue

I used the version that the /home/tutorial/suricataLogs suggests. When i run filebeat setup I get this message. If i run filebeat -c filebeat.yml -e it seems that is running. I have the same problem with Zeek also. I think tutorial is insufficient .

@clouca , in order to be able to connect to Elasticsearch OSS you should use Filebeat OSS. Download Filebeat • Lightweight Log Analysis | Elastic - can connect to the Elasticsearch Download Filebeat - OSS • Lightweight Log Analysis | Elastic - can connect to the Elastichsearch OSS If you use Open …

I used the correct versions but no success. Now i get the error x509: certificate signed by unknown authority

You probably can try to configure Filebeat with appropriate certificates of the your Elasticsearch cluster like it is described in the documentation - Configure SSL . You also can use ssl.verification_mode: none to check if it is related to your self-signed certificates.

I have already done that but seems that filebeat does not taking into account this option

What is in your output.elasticsearch is specified now? From the documentation: Configure the Elasticsearch output : output.elasticsearch: ssl.verification_mode: none hosts: ["https://localhost:9200"] # hosts: ["localhost"] # protocol: https

From the documentation: Configure the Elasticsearch output : output.elasticsearch: ssl.verification_mode: none hosts: ["https://localhost:9200"] # hosts: ["localhost"] # protocol: https [Screenshot 2020-09-02 at 15.34.27] [Screenshot 2020-09-02 at 15.35.12] You a trying to connect to th…

Filebeat not connecting

General Feedback

clouca September 2, 2020, 12:02pm 10

As you can find in my first post which i posted my config the ssl.verification_mode: none is already there. Every time I make a setup of opendistro different things happened. Cannot explain this instability.

Topic		Replies	Views
Filebeat and Opendistro failed Security	4	3006	July 28, 2021
Error during metricbeat or filebeat setup General Feedback troubleshoot	6	16984	January 25, 2022
ILM is not supported by the Elasticsearch version in use: Elasticsearch 2.15.0 does not support ILM Security	1	245	November 7, 2024
Deploying filebeat error Open Source Elasticsearch and Kibana all-clients , releases	1	974	February 7, 2023
Can't connect Metricbeat to opensearch OpenDistro	6	3593	July 5, 2022

Filebeat not connecting

Related topics