Elasticsearch fix read only index

In case you have been low on disk space on your Elasticsearch instance, there is high probability that your indices are marked read only now. In order to fix this one, first either delete/archive indices or increase your disk space. After that restart Elasticsearch and Kibana and navigate to Management – Dev Tools and execute the following: This should bring indices back to be writable once again.

Geo location with Filebeat on Elasticsearch 7, HAProxy and NGINX

Display geo location map for NGINX traffic logs in Kibana Summary There are 3 things to remember and configure in order to have geo location map working: Use “forwardfor” option on pfSense HAProxy TLS frontend Enable filebeat NGINX module and point particular log files Define custom NGINX log format This guide relates to Ubuntu Linux setup. Elasticsearch 7 First install Elasticsearch 7 as follows. Note: for more resilent setup install…

Recovering Elasticsearch 7 after power outage

In case you encounted power outage or just blindly pressed restart button on your machine, there is high chance you will have some issues with your cluster. Mine has only one node, so there is no redundancy. If I lose indices then data is gone. Fortunately starting Elasticsearch and having red indicators not necessarily means data lose. I recently went that path. Log says that primary shards was missing. In…

Installing Metricbeat 7.17 agent on Ubuntu

Once you have installed Elasticsearch and Kibana servers you need to grab some data. First choice could be beats modules, either Metricbeat or Packetbeat. There is also Filebeat. Altough installation instructions are available at https://www.elastic.co/guide/en/beats/metricbeat/7.17/metricbeat-installation-configuration.html I found it useful to describe it separately as this page might just disappear out of a sudden. After installation you need to change the configuration file at: Change Kibana and Elasticsearch output addresses. Then…

Elasticsearch 7: Could not locate that index-pattern

Recently I’ve been tryout Elasticsearch 7 with Kibana and Metricbeat as well as Filebeat. I encountered some issues with indices so I dropped dashboards and visualizations and tried to load them again. I also cleared indices and patterns thru index management page. If you get error message like “could not locate that index-pattern” or something with fields being non-optimized then you should take few actions. Please note that it was…

WordPress Appliance - Powered by TurnKey Linux