Is the Sidecar documentation up to date?

Graylog Central (peer support)
1

The 3.1 version of the Graylog Sidecar documentation reads:

Now in the Sidecar Beats Output Configuration you just mark Enable TLS Support and Insecure TLS connection .

Is this correct? Isn’t this about the legacy Collectors? Where to find the Beats Output Configuration in the new Sidecar system?

Does anybody have an idea how to automatically use TLS between my Beats input and an external Filebeat instance? If I check Enable TLS in the Beats input settings, logs don’t get through. I don’t need “certificate based client authentication”; just a secure connection will be sufficient.

2

He @JBMan

multiple parts here:

So you checked the “enable tls” on the beats input - great. Did you configure the beat to trust self signed certificates too?

What does the log tell you?

3

Hi Jan, thank you for your reply! I really love Graylog and it’s great and helpful community.

When I set Enable TLS in the Beats input settings, I see these errors in Filebeat:

ERROR	logstash/async.go:256	Failed to publish events caused by: read tcp X.X.X.X:38744->X.X.X.X:5044: read: connection reset by peer
ERROR	logstash/async.go:256	Failed to publish events caused by: client is not connected
ERROR	pipeline/output.go:121	Failed to publish events: client is not connected

Did you configure the beat to trust self signed certificates too?

Where can I configure that? According to the docs I should change the “Beats Output Configuration” and set “Enable TLS Support” and “Insecure TLS connection”. But where can I find the “Beats Output Configuration”? I can only find this at “Collectors (legacy)”. Does this really apply to the new Sidecar system?

4

as you need to write the configuration for filebeat yourself - you can’t just check a box for that.

but you are right - that part of the docs need some love.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.