Issues with inactive sidecar

Graylog Central (peer support)
1

Hi I am having a little issue trying to getting the sidecar working, and keeps saying that it is failing to connect and keeps failing. When checking the status I get this error:

level=error msg=“Error fetching server version Get "https://0.0.0.0:9000/api\”: net/http: TLS handshake timeout

This is the image from the sidecar page

image
image2218×553 48 KB

I have set the server url in the sidecar.yml to:
server_url: “https://0.0.0.0:9000/api/”

Which is the bind address of the server. I thought the problem might be the http_publish_uri, which I set to the same as the bind address

I am currently running this through WSL. Not too sure what I should check next or where to go from here.

On a sidenote, I am trying to set up a server that will read specific log files from directory, would there be a better way to so it without using sidecar?

Thanks

2

image
image1720×370 19 KB

This is the image shown on the failure tracker as well. I haven’t touched the config files, so I’m unsure what has happened

3

Hello @mromeo,

The non loopback IP address that 0.0.0.0 binds to on your Graylog server is what you should have have within the server URL option in the sidecar.yml, unless you are using a loadbalancer.

In this case your issue point to an SSL issue, unless you want to implement SSL please try the below option within the sidecar.yml

tls_skip_verify: true

4

I forgot to mention that I already tried to set tsl_skip_verify: true and the issue still persists. I also used the ip under eth0: inet

image
image1080×477 23.4 KB

Is there anything else that could be an issue?

5

Hey @mromeo,

What’s a little confusing is that from your pictures it appears the Sidecar instance is talking to Graylog and Filebeat is running. Auditbeat is failing but you don’t require this if you are just looking to ingest a specific log file.

When tailing the log file under the path generated for your Filebeat instance (Something like this /var/lib/graylog-sidecar/generated/653f97d6ecdb7073e885337f/log), what is the error being thrown there?