Nagios Log Server failure to start properly

[kevinmjacobsen]

Web page stays at "Waiting for Elasticsearch"

Logstash contains the following:
{:timestamp=>"2023-08-24T13:50:07.457000-0500", :message=>"Attempted to send a bulk request to Elasticsearch configured at '[\"http://localhost:9200\"]', but Elasticsearch appears to be unreachable or down!", :error_message=>"Connection refused (Connection refused)", :class=>"Manticore::SocketException", :level=>:error}

There is nothing in backups.
ls -la /store/backups/nagioslogserver/
total 0
drwxr-xr-x. 2 nagios nagios 6 Mar 31 23:53 .
drwxr-xr-x. 3 nagios nagios 29 Nov 25 2020 ..

I've just adopted this instance and I'm not having any luck getting this to let me login and begin admin of this Log Server.

Any suggestions???

[kg2857]

Sounds like Elasticsearch isn't running.
There should be a script to reset the nagiosadmin password so you can log into the web GUI once ES is running.

[ssunga]

Thanks for reaching out, kevinmjacobsen.

Based on the error message you've provided, it appears that Logstash is unable to connect to Elasticsearch. This could be due to several reasons such as Elasticsearch not running, network issues, or configuration errors.

First, let's check if Elasticsearch is running. You can do this by executing the following command on your server:

Code: Select all

sudo systemctl status elasticsearch

If it's not running, try starting it with:

Code: Select all

sudo systemctl start elasticsearch

After attempting to start Elasticsearch, check the logs for any startup errors which might give us a clue as to what's going wrong:

Code: Select all

sudo journalctl -u elasticsearch

If Elasticsearch is running properly, then the issue might be network-related or a misconfiguration. Verify that Elasticsearch is indeed running on localhost:9200 and that no firewall rules are blocking the connection.

Also, ensure that the configuration files for Logstash and Elasticsearch are correctly set up to communicate with each other, and check the Elasticsearch logs for any clues:

Code: Select all

ls -la /var/log/elasticsearch/

It's also worth noting that if you've just adopted the instance and the previous admin had set it up differently, you may need to check for any custom configuration files or scripts that are meant to run Elasticsearch or Logstash.

If these steps do not resolve the issue, please provide additional logs or configuration file snippets for more targeted troubleshooting.

Best of luck!