Metricbeat doesn't work properly with api_key in metricbeat elasticsearch module but work ok with username\password
the same api_key works fine in the output.elasticsearch.api_key
/etc/metricbeat/modules.d/elasticsearch-xpack.yml
---
- module: elasticsearch
xpack.enabled: true
period: 10s
hosts: ["https://fqdn:8443"]
ssl:
certificate_authorities:
- /etc/ssl/certs/ca-certificates.crt
api_key: xxxxxxx:yyyyyyyy! note that the same api_key works fine in /etc/metricbeat/metricbeat.yml
---
output:
elasticsearch:
hosts: ['https://server-01:9200', 'https://server-02:9200', ...]
ssl:
certificate_authorities: ['/etc/ssl/certs/ca-certificates.crt']
api_key: xxxxxxx:yyyyyyyy
metricbeat:
config:
modules:
path: ${path.config}/modules.d/*.yml
reload:
enabled: false
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
error log:
....
Dec 4 21:12:00 elasticsearch-01 metricbeat[214918]: 2021-12-04T21:12:00.767Z#011INFO#011module/wrapper.go:259#011Error fetching data for metricset elasticsearch.node_stats: HTTP error 401 in : 401 Unauthorized
Dec 4 21:12:10 elasticsearch-01 metricbeat[214918]: 2021-12-04T21:12:10.606Z#011INFO#011module/wrapper.go:259#011Error fetching data for metricset elasticsearch.enrich: error determining if connected Elasticsearch node is master: HTTP error 401 in : 401 Unauthorized
Dec 4 21:12:10 elasticsearch-01 metricbeat[214918]: 2021-12-04T21:12:10.610Z#011INFO#011module/wrapper.go:259#011Error fetching data for metricset elasticsearch.cluster_stats: error determining if connected Elasticsearch node is master: HTTP error 401 in : 401 Unauthorized
Dec 4 21:12:10 elasticsearch-01 metricbeat[214918]: 2021-12-04T21:12:10.632Z#011INFO#011module/wrapper.go:259#011Error fetching data for metricset elasticsearch.index: error determining if connected Elasticsearch node is master: HTTP error 401 in : 401 Unauthorized
Dec 4 21:12:10 elasticsearch-01 metricbeat[214918]: 2021-12-04T21:12:10.660Z#011INFO#011module/wrapper.go:259#011Error fetching data for metricset elasticsearch.shard: error determining if connected Elasticsearch node is master: HTTP error 401 in : 401 Unauthorized
....
- Version:
metricbeat/stable,now 7.15.2 amd64 [installed]
- Operating System:
Debian GNU/Linux 11 (bullseye)
solution: use username\password instead of api_key in /etc/metricbeat/modules.d/elasticsearch-xpack.yml
Metricbeat doesn't work properly with
api_keyin metricbeat elasticsearch module but work ok withusername\passwordthe same
api_keyworks fine in theoutput.elasticsearch.api_key/etc/metricbeat/modules.d/elasticsearch-xpack.yml! note that the same
api_keyworks fine in/etc/metricbeat/metricbeat.ymlerror log:
metricbeat/stable,now 7.15.2 amd64 [installed]Debian GNU/Linux 11 (bullseye)solution: use username\password instead of api_key in
/etc/metricbeat/modules.d/elasticsearch-xpack.yml