Telegraf inputs.elasticsearch should query only local stats -- 2.3.130

[samanosuke26]

Telegraf errors in log:
E! [inputs.elasticsearch] Error in plugin: Get "https://NODEIP:9200/_nodes/stats": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
E! [inputs.elasticsearch] Error in plugin: context deadline exceeded (Client.Timeout or context cancellation while reading body)

Within /opt/so/conf/telegraf/etc/telegraf.conf:
[[inputs.elasticsearch]]
servers = ["https://localhost:9200"]
cluster_stats = false
username = "USERNAME"
password = "PASSWORD"
insecure_skip_verify = true
# ## Timeout for HTTP requests to the elastic search server(s)
# http_timeout = "5s"
#
# ## When local is true (the default), the node will read only its own stats.
# ## Set local to false when you want to read the node stats from all nodes
# ## of the cluster.
# local = true

The configuration file states that local = true is the default, however the error logs above seem to indicate its attempting to query all the nodes.

Adding local = true under the telegraf.conf jinja filters for the searchnodes and manager fixes this.

[dougburks]

Your title seems to indicate that you are running version 2.3.130. That version is from June of last year:
https://blog.securityonion.net/2022/06/security-onion-23130-now-available.html

You might want to try updating to 2.3.260 to see if the issue goes away:
https://blog.securityonion.net/2023/06/security-onion-23260-now-available.html

Also note that Security Onion 2.4 is now available:
https://blog.securityonion.net/2023/08/security-onion-24-has-reached-general.html

[samanosuke26]

Yes, thank you. I wanted to make this issue was noted for devs or other users.