Hello,
I’m running these versions for our two node (server) ELK stack on CentOS 6.7.
Logstash 1.5.3
Elasticsearch 1.7.1
Kibana 4.0.1
Redis 2.8.6
search-guard 1.7.3.0
I installed bin/plugin -i com.floragunn/search-guard/1.7.3.0. Then configured the elasticsearch.yml, kibana.yml and the authentication works where I can log into elasticsearch and kibana. I’m using just the basic authentication setup in the https://github.com/floragunncom/search-guard/blob/master/searchguard_config_example_1.yml example to see if I can get it working.
My issue is that the Logstash indexer isn’t updating elasticsearch. I tried this in the indexer.conf file and the log says “Error: User and password parameters are not supported for ‘node’. Change the protocol to ‘http’ if you need them.”
output {
elasticsearch {
cluster => “elasticsearch_preprod”
user => “admin”
password => “secret”
}
}
Then I tried with this configuration below and I get {:timestamp=>“2016-03-17T14:20:36.798000-0500”, :message=>“Unknown setting ‘cluster’ for elasticsearch_http”, :level=>:error}.
output {
elasticsearch_http {
cluster => “elasticsearch_preprod”
user => “admin”
password => “secret”
}
}
Then I tried with this configuration below and I get {:timestamp=>“2016-03-17T14:24:00.313000-0500”, :message=>“Invalid setting for elasticsearch_http output plugin:\n\n output {\n elasticsearch_http {\n # This setting must be a string\n # Expected string, got ["172.26.2.209:9200", "172.26.2.240:9200"]\n host => ["172.26.2.209:9200", "172.26.2.240:9200"]\n …\n }\n }”, :level=>:error}
output {
elasticsearch_http {
host => [“172.26.2.209:9200”, “172.26.2.240:9200”]
user => “admin”
password => “secret”
}
}
Then I tried with this configuration below and I get {:timestamp=>“2016-03-17T14:25:04.250000-0500”, :message=>“Unknown setting ‘hosts’ for elasticsearch_http”, :level=>:error}
output {
elasticsearch_http {
hosts => [“172.26.2.209:9200”, “172.26.2.240:9200”]
user => “admin”
password => “secret”
}
}
So I’m looking for suggestions on how to configure so the indexer will update elasticsearch in my cluster. Thank you.