Beats Input state pending between run and not run on all nodes


We have a Beats Input setup in Graylog 3.1, the problem is that the Beats Input is pending between running and not running on all three nodes. So all 3 Inputs are not always up and running. Is this a normal behavior?

I’ve also noticed that if you try to stop the input via the GUI it won’t stop on all three nodes. This causes problems when trying to start the input again with error messages from the node where the input didn’t stop.

Our current Graylog Setup:

Graylog 3.1 (Upgraded from 2.5)
3 Graylog nodes
4 separate ES data nodes.


what did you configured how? What is visible in the Graylog log?

The following input is configured:


no_beats_prefix: false
number_worker_threads: 3
port: 5044
tcp_keepalive: false
tls_cert_file: /etc/graylog/beats.crt
tls_client_auth: required
tls_client_auth_cert_file: /etc/graylog/
tls_enable: true
tls_key_file: /etc/graylog/beats.key
tls_key_password: *******************************

The logs only shows that the Inputs are started. Can’t really get any more info about why the go up and down all the time.

I just guess that the certificate keys are not accessible for the Graylog user - or similar

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.