All Apps and Add-ons

Elasticsearch Data integrator Stops ingesting logs intermittently to Splunk

keen
Loves-to-Learn Lots

We are running Elasticsearch Data integrator -modular input to ingest logs from elasticsearch to Splunk. However, the app only works when Splunk is restarted and the app stops working a few minutes later until the next time Splunk is restarted again.

Error message:

ERROR PersistentScript [3778898 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/TA_elasticsearch_data_integrator___modular_input_rh_settings.py persistent}: f"Failed to get password of realm={self._realm}, user={user}."

Can you help fix the problem?

 

Labels (2)
0 Karma

livehybrid
Ultra Champion

Hi @keen 

Its odd that it would work once but then stop with that error. As far as I know, the settings page within the app only has a single encrypted value which is proxy_password - are you using a proxy with the input?

Are there any other error lines around the one you posted which might provide more information?

:glowing_star: Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

keen
Loves-to-Learn Lots

No, I am not using proxy however when I set the Time Format, Time_prefix and MAX_TIMESTAMP_LOOKAHEAD it started working.

Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...