Beats Input state pending between run and not run on all nodes

[Sebhan (Sebastian)]

Hi,

We have a Beats Input setup in Graylog 3.1, the problem is that the Beats Input is pending between running and not running on all three nodes. So all 3 Inputs are not always up and running. Is this a normal behavior?

I’ve also noticed that if you try to stop the input via the GUI it won’t stop on all three nodes. This causes problems when trying to start the input again with error messages from the node where the input didn’t stop.

Our current Graylog Setup:

Graylog 3.1 (Upgraded from 2.5)
3 Graylog nodes
4 separate ES data nodes.

Capture|321x77

[jan (Jan Doberstein)]

what did you configured how? What is visible in the Graylog log?

[Sebhan (Sebastian)]

The following input is configured:

Beats

bind_address: 0.0.0.0
no_beats_prefix: false
number_worker_threads: 3
override_source:
port: 5044
recv_buffer_size:425984
tcp_keepalive: false
tls_cert_file: /etc/graylog/beats.crt
tls_client_auth: required
tls_client_auth_cert_file: /etc/graylog/beats.ca.crt
tls_enable: true
tls_key_file: /etc/graylog/beats.key
tls_key_password: *******************************

The logs only shows that the Inputs are started. Can’t really get any more info about why the go up and down all the time.

[jan (Jan Doberstein)]

I just guess that the certificate keys are not accessible for the Graylog user - or similar