Elasticsearch Data integrator Stops ingesting logs intermittently to Splunk

[keen]

We are running Elasticsearch Data integrator -modular input to ingest logs from elasticsearch to Splunk. However, the app only works when Splunk is restarted and the app stops working a few minutes later until the next time Splunk is restarted again.

Error message:

ERROR PersistentScript [3778898 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/TA_elasticsearch_data_integrator___modular_input_rh_settings.py persistent}: f"Failed to get password of realm={self._realm}, user={user}."

Can you help fix the problem?

[livehybrid]

Hi @keen 

Its odd that it would work once but then stop with that error. As far as I know, the settings page within the app only has a single encrypted value which is proxy_password - are you using a proxy with the input?

Are there any other error lines around the one you posted which might provide more information?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[keen]

No, I am not using proxy however when I set the Time Format, Time_prefix and MAX_TIMESTAMP_LOOKAHEAD it started working.

Thanks for your help.