NLS & Metricbeat

[shifty]

Hi,

Is there anyone in the community who got metricbeat up and running in cooperation with NLS? Or is this even possible?
I followed the instructions from https://www.elastic.co/guide/en/beats/m ... ation.html

For example, when I try to test metricbeat I get following error:

talk to server... ERROR Connection marked as failed because the onConnect callback failed: could not connect to a compatible version of Elasticsearch: 400 Bad Request: {"error":"ElasticsearchIllegalArgument"}

Thanks for any help

Shifty

[ssax]

I setup this input in Log Server in Configure > Global Config > Inputs:

Code: Select all

beats {
  port => 5044
}

Then Saved and Applied Configuration.

I installed metricbeat on the sending device, then edited the /etc/metricbeat/metricbeat.yml to set the logstash output (I commented out the output.elasticsearch lines and uncommented/set these):

Code: Select all

output.logstash:
  # The Logstash hosts
  hosts: ["X.X.X.X:5044"]

Then restarted metricbeat on the sending system and I see them coming in and being parsed properly:

Code: Select all

systemctl restart metricbeat

[shifty]

Hi

thank you, your config worked ! Have you ever tried to run the metricbeat template "Metricbeat-system-overview.json"? You can find it under "/etc/metricbeat/kibana/7/dashboard" Unfortunately nothing happens when I load it as a dashboard.

Metricbeat now provides me with a lot of data, but somehow I can't really do anything with it. Here's an example:

Code: Select all

2021-06-30T08:22:24.410+0200#011INFO#011[monitoring]#011log/log.go:144#011Non-zero metrics in the last 30s#011{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":8920,"time":{"ms":220}},"total":{"ticks":23140,"time":{"ms":553},"value":23140},"user":{"ticks":14220,"time":{"ms":333}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":9},"info":{"ephemeral_id":"c57d16b4-08df-471c-909c-a99a7c6defee","uptime":{"ms":1200134}},"memstats":{"gc_next":17271888,"memory_alloc":10465272,"memory_total":2536237992,"rss":166051840},"runtime":{"goroutines":61}},"libbeat":{"config":{"module":{"running":3}},"output":{"events":{"acked":53,"active":0,"batches":6,"total":53},"read":{"bytes":36},"write":{"bytes":13505}},"pipeline":{"clients":10,"events":{"active":0,"published":53,"total":53},"queue":{"acked":53}}},"metricbeat":{"system":{"cpu":{"events":3,"success":3},"load":{"events":3,"success":3},"memory":{"events":3,"success":3},"network":{"events":12,"success":12},"process":{"events":26,"success":26},"process_summary":{"events":3,"success":3},"socket_summary":{"events":3,"success":3}}},"system":{"load":{"1":0.01,"15":0,"5":0.02,"norm":{"1":0.0025,"15":0,"5":0.005}}}}}}

Thanks for any help !

[ssax]

I have not used metricsbeat outside of just labbing it up. We have no knowledge of it here as it's not our product.

The version of Kibana those dashboards are written for is Kibana 7.

Nagios Log Server uses 3.1.1-nagios-5 so they aren't compatible.