I am using OSS Winlogbeat Version 7.1.1 with Opendistro Elasticsearch running in a docker container.
winlogbeat throw an error when trying to send logs to elasticsearch.
2019-08-22T15:24:08.961+0530 INFO elasticsearch/client.go:734 Attempting to connect to Elasticsearch version 7.1.1
…
…
…2019-08-22T15:25:10.934+0530 ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(https://xxxxxxxxxxxxxx.com:9200)): Connection marked as failed because the onConnect callback failed: Error loading Elasticsearch template: could not load template. Elasticsearch returned: couldn’t load template: couldn’t load json. Error: 503 Service Unavailable: {“error”:{“root_cause”:[{“type”:“master_not_discovered_exception”,“reason”:null}],“type”:“master_not_discovered_exception”,“reason”:null},“status”:503}. Response body: {“error”:{“root_cause”:[{“type”:“master_not_discovered_exception”,“reason”:null}],“type”:“master_not_discovered_exception”,“reason”:null},“status”:503}. Template is: map[index_patterns:[winlogbeat-7.1.1-] mappings:{“_meta”:{“beat”:“winlogbeat”,“version”:“7.1.1”},“date_detection”:false,“dynamic_templates”:[{“labels”:{“mapping”:{“type”:“keyword”},“match_mapping_type”:“string”,“path_match”:"labels."}},{“container.labels”:{“mapping”:{“type”:“keyword”},“match_mapping_type”:“string”,“path_match”:“container.labels."}},{“fields”:{“mapping”:{“type”:“keyword”},“match_mapping_type”:“string”,“path_match”:"fields.”}},{“docker.container.labels”:{“mapping”:{“type”:“keyword”},“match_mapping_type”:“string”,“path_match”:“docker.container.labels.*”}},
Below is an excerpt from winlogbeat.yaml
output.elasticsearch:
Array of hosts to connect to.
hosts: [“https://xxxxxxxxxxxxxx.com:9200”]
Optional protocol and basic auth credentials.
protocol: “https”
username: “user”
password: “password”
ssl.verification_mode: none