Filebeat on Linux and Google Workspace plugin

Graylog Central (peer support)
, ,
1

Currently trying to setup a second Filebeat input from a Linux host using graylog-sidecar-1.1.0 and
filebeat-7.12. Both inputs are working but the second is throwing these errors in the filebeat log every second:

    2021-03-30T12:19:21.355-0400	INFO	[publisher]	pipeline/retry.go:223	  done
    2021-03-30T12:19:21.356-0400	INFO	[publisher_pipeline_output]	        pipeline/output.go:151	Connection to backoff(async(tcp://10.10.10.10:5046)) established
    2021-03-30T12:19:21.356-0400	ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: unsupported float value: NaN
    2021-03-30T12:19:21.356-0400	INFO	[publisher]	pipeline/retry.go:219	retryer: send unwait signal to consumer
    2021-03-30T12:19:21.356-0400	INFO	[publisher]	pipeline/retry.go:223	  done

Setup:
Graylog 4.0.5 - 3 node cluster
Haproxy load balancing to Nginx.
Nginx proxying to local 9000 on the host
All Centos 7

Sidecar on Centos7
graylog-sidecar-1.1.0-1.x86_64
filebeat-7.12.0-1.x86_64

First filebeat base config for Linux:

    # Needed for Graylog
    fields_under_root: true
    fields.collector_node_id: ${sidecar.nodeName}
    fields.gl2_source_collector: ${sidecar.nodeId}
    
    filebeat.inputs:
    - input_type: log
      paths:
        - /var/log/messages
      type: linux-log-file-messages
    - input_type: log
      paths:
        - /var/log/secure
      type: linux-log-file-secure
    - input_type: log
      paths:
        - /var/log/yum.log
      type: linux-log-file-yum
    - input_type: log
      paths:
        - /var/log/maillog
      type: linux-log-file-maillog
    - input_type: log
      paths:
        - /var/log/cron
      type: linux-log-file-cron
    output.logstash:
       hosts: ["10.10.10.10:5045", "10.10.10.11:5045", "10.10.10.12:5045"]
       loadbalance: true
    path:
      data: /var/lib/graylog-sidecar/collectors/filebeat/data
      logs: /var/lib/graylog-sidecar/collectors/filebeat/log

Second config for Google Workspace:

    # Needed for Graylog
    fields_under_root: true
    fields.collector_node_id: ${sidecar.nodeName}
    fields.gl2_source_collector: ${sidecar.nodeId}
    #logging.metrics.enabled: false
    #monitoring.enabled: false
    
    filebeat.modules:
    - module: google_workspace
      saml:
        enabled: true
        var.jwt_file: "/root/integration-57435723489.json"
        var.delegated_account: "service@company.com"
      user_accounts:
        enabled: true
        var.jwt_file: "/root/integration-57435723489.json"
        var.delegated_account: "service@company.com"
      login:
        enabled: true
        var.jwt_file: "/root/integration-57435723489.json"
        var.delegated_account: "service@company.com"
      admin:
        enabled: true
        var.jwt_file: "/root/integration-57435723489.json"
        var.delegated_account: "service@company.com"
      drive:
        enabled: true
        var.jwt_file: "/root/integration-57435723489.json"
        var.delegated_account: "service@company.com"
      groups:
        enabled: true
        var.jwt_file: "/root/integration-57435723489.json"
        var.delegated_account: "service@company.com"
    output.logstash:
       hosts: ["10.10.10.10:5046", "10.10.10.11:5046", "10.10.10.12:5046"]
       loadbalance: true
    path:
      data: /var/lib/graylog-sidecar/collectors/filebeat/data-gsuite
      logs: /var/lib/graylog-sidecar/collectors/filebeat/log-gsuite

Thinking the issue has to do with a second filebeat trying to report metrics. I tried disabling them for the second input with the currently commented out lines above with no luck.

2

This appears to be an issue with throttling. Not sure which side the issue is on but it seems like it’s Google. Setting all but login to false let the logs start ingesting. Will try to enable the others after those are done syncing.

3

May also be related to this:

Polling the same data indefinitely.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.