By using AWS re:Post, you agree to the Terms of Use
/Importing Filebeat or Metricbeat dashboard on Amazon Elasticserach Kibana/

Importing Filebeat or Metricbeat dashboard on Amazon Elasticserach Kibana

0

Hi all, I'm trying to figure it out if/how is possible to import Filebeat/Metricbeat dashboards on ES Kibana. It seems possible, at least with older version of ES: https://discuss.elastic.co/t/installing-metricbeat-dashboards-on-kibana-for-amazon-elasticsearch/102180

But in other case seems to fail: https://forums.aws.amazon.com/thread.jspa?threadID=279402

Do you know if that is possible and which are the limitations? Thanks!

asked 2 years ago32 views
1 Answers
0
Accepted Answer

Yes, it's possible but you have to use the OSS version of filebeat/metricbeat/x-beat

https://www.elastic.co/downloads/beats/filebeat-oss

https://www.elastic.co/downloads/beats/metricbeat-oss

The non OSS version for x-beat will check for x-pack (so it checks if the ES cluster is from Elastic, which in the case of Amazon ES is not). Other than that, it seems that we may have authorization issue in the dashboard import.

If FGAC (https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/fgac.html) is on (with internal CS users), the import fails with the following error:

error loading /Users/xxx/filebeat-7.8.0-darwin-x86_64/kibana/7/dashboard/osquery-rootkit.json: returned 401 to import file: <nil>. Response: {"message":"Session expired","redirectTo":"login"}

If FGAC is turned off, the import seems to work. If you want to keep FGAC and import the dashboard, you can setup a IAM user beside the internal primary user (you can just create the cluster with a IAM primary user and then switch to internal primary, using "modify authentication"). If you then setup AWS ES Kibana Proxy https://www.npmjs.com/package/aws-es-kibana, you will be able to import the dashboard using the IAM users key via the proxy.

It's still unclear why the basic authentication is not working, while it should.

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions