How to configure Filebeat on ECK for kafka input?

2/4/2021

I have Elasticsearch and Kibana running on Kubernetes. Both created by ECK. Now I try to add Filebeat to it and configure it to index data coming from a Kafka topic. This is my current configuration:

apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
   name: my-filebeat
   namespace: my-namespace
spec:
   type: filebeat
   version: 7.10.2
   elasticsearchRef:
       name: my-elastic
   kibanaRef:
       name: my-kibana
   config:
       filebeat.inputs:
       - type: kafka
         hosts:
         - host1:9092
         - host2:9092
         - host3:9092
         topics: ["my.topic"]
         group_id: "my_group_id"
         index: "my_index"
   deployment:
       podTemplate:
           spec:
               dnsPolicy: ClusterFirstWithHostNet
               hostNetwork: true
               securityContext:
                   runAsUser: 0
               containers:
               - name: filebeat

In the logs of the pod I can see entries like following

log/log.go:145	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":2470,"time":{"ms":192}},"total":{"ticks":7760,"time":{"ms":367},"value":7760},"user":{"ticks":5290,"time":{"ms":175}}},"handles":{"limit":{"hard":1048576,"soft":1048576},"open":13},"info":{"ephemeral_id":"5ce8521c-f237-4994-a02e-dd11dfd31b09","uptime":{"ms":181997}},"memstats":{"gc_next":23678528,"memory_alloc":15320760,"memory_total":459895768},"runtime":{"goroutines":106}},"filebeat":{"harvester":{"open_files":0,"running":0},"inputs":{"kafka":{"bytes_read":46510,"bytes_write":37226}}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"load":{"1":1.18,"15":0.77,"5":0.97,"norm":{"1":0.0738,"15":0.0481,"5":0.0606}}}}}}

And nor error entries are there. So I assume that the connection to Kafka works. Unfortunately, there no data in the my_index specified above. What do I do wrong?

-- Ira Re
elastic-stack
elasticsearch
filebeat
kubernetes

1 Answer

2/4/2021

I guess you are not able to connect to the Elasticsearch mentioned in the output.

As per docs, ECK secures the Elasticsearch deployed and stores it in the Kubernetes Secrets.

https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html

-- Aravind
Source: StackOverflow