[question] Failed to publish topology

[ciroiriarte]

I followed the quick start guide and got this error:

Jul 5 09:12:39 vm00 /usr/bin/packetbeat[7866]: publish.go:342: Using http://localhost:9200/opt/elasticsearch as publisher
Jul 5 09:12:39 vm00 /usr/bin/packetbeat[7866]: publish.go:343: Using index pattern [packetbeat-]YYYY.MM.DD
Jul 5 09:12:39 vm00 /usr/bin/packetbeat[7866]: publish.go:353: No agent name configured, using hostname 'vm00.linux.com.py'
Jul 5 09:12:39 vm00 /usr/bin/packetbeat[7866]: publish.go:371: Failed to publish topology: Put http://localhost:9200/opt/elasticsearch/packetbeat-topology/server-ip/10.1.1.108: malformed HTTP status code "handler"
Jul 5 09:12:39 vm00 /usr/bin/packetbeat[7866]: main.go:252: Put http://localhost:9200/opt/elasticsearch/packetbeat-topology/server-ip/10.1.1.108: malformed HTTP status code "handler"
Jul 5 09:24:51 vm00 /usr/bin/packetbeat[7956]: publish.go:342: Using http://localhost:9200/opt/elasticsearch as publisher
Jul 5 09:24:51 vm00 /usr/bin/packetbeat[7956]: publish.go:343: Using index pattern [packetbeat-]YYYY.MM.DD
Jul 5 09:24:51 vm00 /usr/bin/packetbeat[7956]: publish.go:353: No agent name configured, using hostname 'vm00.linux.com.py'
Jul 5 09:24:51 vm00 /usr/bin/packetbeat[7956]: publish.go:371: Failed to publish topology: Put http://localhost:9200/opt/elasticsearch/packetbeat-topology/server-ip/10.1.1.108: malformed HTTP status code "handler"
Jul 5 09:24:51 vm00 /usr/bin/packetbeat[7956]: main.go:252: Put http://localhost:9200/opt/elasticsearch/packetbeat-topology/server-ip/10.1.1.108: malformed HTTP status code "handler"

The only difference is that I installed ElasticSearch 1.2.1, could that be the cause?

[ciroiriarte]

Downgraded to 1.1.2, after wiping /var/lib/elasticsearch, same issue.

[packetb-old]

Hi, if you are using packetbeat version 0.2.1, please upgrade to 0.2.2. There was a nasty bug (#33) causing packetbeat to connect to localhost despite configured otherwise.

We'll update the getting started guide to use a newer elasticsearch version, that shouldn't make any difference, sorry for the confusion.

[ciroiriarte]

This is the installed version:

[root@vm00 ~]# rpm -q packetbeat
packetbeat-0.2.2-1.el6.x86_64

[packetb-old]

Ah, it's already 0.2.2. Can you post your packetbeat.conf, please?

[ciroiriarte]

Here it is:

[elasticsearch]
host = "localhost"
port = 9200

index = "packetbeat"
path = "/opt/elasticsearch"

[interfaces]
device = "any"

[protocols]
[protocols.http]
ports = [80, 8080, 8000, 5000, 8002]

[protocols.mysql]
ports = [3306]

[protocols.redis]
ports = [6379]

[protocols.pgsql]
ports = [5432]

[procs]

[procs.monitored.mysqld]
cmdline_grep = "mysqld"

[procs.monitored.pgsql]
cmdline_grep = "postgres"

[procs.monitored.nginx]
cmdline_grep = "nginx"

[procs.monitored.httpd]
cmdline_grep = "httpd"

[agent]

[runoptions]

[logging]
selectors = ["pinger"]

[passwords]

[packetb-old]

You don't need to set the [elasticsearch] path. That option is useful only when running Elasticsearch behind nginx, that exposes ES under a custom "path". We should probably rename that to http_path in order to clarify. So setting the path to "" should solve the issue.

[ciroiriarte]

That did it, thanks!

[packetb-old]

Great, keep us up to date on how the installation is going, please!