fluentd elasticsearch plugin - The client is unable to verify that the server is Elasticsearch

user_6745734 0
Viewed 5654

I want to send some nginx logs from fluentd to elasticsearch , however, fluentd is unable to start due to following error message:

The client is unable to verify that the server is Elasticsearch. Some functionality may not be compatible if the server is running an unsupported product.

[error]: #0 unexpected error error_class=Elasticsearch::UnsupportedProductError error="The client noticed that the server is not Elasticsearch and we do not support this unknown product."

enter image description here

This is my fluentd config :

<source>
  @type tail  
    <parse>    
      @type nginx 
    </parse>  
  path /tmp/lab4/nginx/access.log  
  pos_file /tmp/lab4/nginx/access.po
  tag nginx.access
</source>

<match nginx.**>
 @type elasticsearch
 scheme http
 host 192.168.1.154 
 port 9200 
 with_transporter_log true
 @log_level debug
</match>

If I do a curl http://192.168.1.154:9200 , I can see a response from Elasticsearch with the system version and other info .

For reference I am using :

  • fluentd version 1.14.5
  • fluentd elastic-search-plugin 5.2.0
  • elastic-search 7.12.0

Any idea on what I am doing wrong ?

efk fluentd elasticsearch
2 Answers
user_76702620

for anyone who is facing the issue in docker, the below steps solved the issue for me:

  • need to build the fleutd with the "elasticsearch gem" as per the version of the elasticsearch being used, like below: Dockerfile:
FROM fluent/fluentd
RUN gem install elasticsearch -v 7.6
RUN gem install fluent-plugin-elasticsearch
RUN gem install fluent-plugin-rewrite-tag-filter
RUN gem install fluent-plugin-multi-format-parser
  • Mention the es version in the out plugin of es in fluent.conf:
@type elasticsearch
host 10.10.13.21
port 9200
verify_es_version_at_startup false
default_elasticsearch_version 7
user_173001140
Related