Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[bug] [filebeat] license expiration breaks filebeat ingestion #21112

Closed
hazcod opened this issue Sep 16, 2020 · 1 comment · Fixed by #22180
Closed

[bug] [filebeat] license expiration breaks filebeat ingestion #21112

hazcod opened this issue Sep 16, 2020 · 1 comment · Fixed by #22180
Assignees
Labels
Team:Services (Deprecated) Label for the former Integrations-Services team

Comments

@hazcod
Copy link
Contributor

hazcod commented Sep 16, 2020

Hi, we noticed that the license expiration will have an averse effect on filebeat log ingestion.
In our case, our trial license expired, breaking filebeat log ingestion and spiking CPU on our log shipping servers.
Altough the documentation mentions filebeat should continue working on license expiration.

Relevant logs from filebeat:

Sep 16 08:41:21 xxx filebeat[2385955]: 2020-09-16T08:41:21.395+0200        INFO        [esclientleg]        eslegclient/connection.go:314        Attempting to connect to Elasticsearch version 7.8.1
Sep 16 08:41:25 xxx filebeat[2385955]: 2020-09-16T08:41:25.851+0200        ERROR        [publisher_pipeline_output]        pipeline/output.go:155        Failed to connect to backoff(elasticsearch(https://127.0.0.1:9200)): Connection marked as failed because the onConnect callback failed: cannot retrieve the elasticsearch license from the /_license endpoint, Filebeat requires the default distribution of Elasticsearch. Please make the endpoint accessible to Filebeat so it can verify the license.: could not extract license information from the server response: unknown state, received: 'expired'
Sep 16 08:41:25 xxx filebeat[2385955]: 2020-09-16T08:41:25.851+0200        INFO        [publisher_pipeline_output]        pipeline/output.go:146        Attempting to reconnect to backoff(elasticsearch(https://127.0.0.1:9200)) with >
Sep 16 08:41:25 xxx filebeat[2385955]: 2020-09-16T08:41:25.851+0200        INFO        [publisher]        pipeline/retry.go:221        retryer: send unwait signal to consumer
Sep 16 08:41:25 xxx filebeat[2385955]: 2020-09-16T08:41:25.851+0200        INFO        [publisher]        pipeline/retry.go:225          done
Sep 16 08:41:25 xxx filebeat[2385955]: 2020-09-16T08:41:25.854+0200        INFO        [esclientleg]        eslegclient/connection.go:314        Attempting to connect to Elasticsearch version 7.8.1

Which mentions in particular:

could not extract license information from the server response: unknown state, received: 'expired'
  • Version: filebeat 7.8.1 (libbeat 7.8.1)
  • Operating System: Red Hat Linux
  • Steps to Reproduce:
  1. Setup working filebeat ingestion to elasticsearch
  2. Expire license
  3. Watch ingestion stop to work
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Sep 16, 2020
@andresrc andresrc added the Team:Services (Deprecated) Label for the former Integrations-Services team label Sep 16, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/integrations-services (Team:Services)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Sep 16, 2020
kvch added a commit that referenced this issue Oct 27, 2020
## What does this PR do?

This PR adds a new licence state named `Expired`. Previously, this prevented Beats from connecting to ES.

## Why is it important?

Beats were not able to parse expired licences. This problem prevented users from using the features of the software which does not require a licence.

## Related issues

Closes #21112
kvch added a commit to kvch/beats that referenced this issue Oct 27, 2020
## What does this PR do?

This PR adds a new licence state named `Expired`. Previously, this prevented Beats from connecting to ES.

## Why is it important?

Beats were not able to parse expired licences. This problem prevented users from using the features of the software which does not require a licence.

## Related issues

Closes elastic#21112

(cherry picked from commit f0da681)
kvch added a commit to kvch/beats that referenced this issue Oct 27, 2020
This PR adds a new licence state named `Expired`. Previously, this prevented Beats from connecting to ES.

Beats were not able to parse expired licences. This problem prevented users from using the features of the software which does not require a licence.

Closes elastic#21112

(cherry picked from commit f0da681)
kvch added a commit that referenced this issue Oct 27, 2020
This PR adds a new licence state named `Expired`. Previously, this prevented Beats from connecting to ES.

Beats were not able to parse expired licences. This problem prevented users from using the features of the software which does not require a licence.

Closes #21112

(cherry picked from commit f0da681)
kvch added a commit that referenced this issue Oct 27, 2020
## What does this PR do?

This PR adds a new licence state named `Expired`. Previously, this prevented Beats from connecting to ES.

## Why is it important?

Beats were not able to parse expired licences. This problem prevented users from using the features of the software which does not require a licence.

## Related issues

Closes #21112

(cherry picked from commit f0da681)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Services (Deprecated) Label for the former Integrations-Services team
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants