Strange variable names and values for filebeat01 in the docker-compose.yml file?

[fterrani]

In docker-compose.yml, environment variables of filebeat01 are defined like this:

    environment:
      - ELASTIC_USER=elastic
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - ELASTIC_HOSTS=https://es01:9200
      - KIBANA_HOSTS=http://kibana:5601
      - LOGSTASH_HOSTS=http://logstash01:9600

I think the http:// and the port number might be incorrect in the LOGSTASH_HOSTS variable. The variable isn't used in filebeat.yml but it sure looks like it could be! During my tests using the logstash output of Filebeat with SSL/TLS, keeping the protocol (but using port 5044 since this seems to be the convention for Beats, 9600 being the web API endpoint) produced this error:

Failed to connect to backoff(async(tcp://[https://logstash01:5044]:5044)): lookup https://logstash01:5044: no such host

And the link from Filebeat to Logstash doesn't work. The value between square brackets looks strange too?... According to the Filebeat configuration docs and how these variables will be used in filebeat.yml:

• setup.kibana.host allows only one URL or host:port; It might be better to rename KIBANA_HOSTS to KIBANA_HOST since the settings expect only one? https://www.elastic.co/guide/en/beats/filebeat/current/setup-kibana-endpoint.html
• output.elasticsearch.hosts allows one or several URL or host:port https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#hosts-option
• output.logstash.hosts seem to allow one or several host:port strings. Docs aren't very clear about this though: https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html#hosts

After using only host and port, some (expected) error message are seen but the Filebeat-Logstash link eventually works:

Failed to connect to backoff(async(tcp://logstash01:5044)): lookup logstash01 on 127.0.0.11:53: no such host
Failed to connect to backoff(async(tcp://logstash01:5044)): dial tcp 172.27.0.2:5044: connect: connection refused

Finally, I haven't tried putting several hosts in the variables but I wonder if it would work? Should they be comma-separated or something?

I did my best to explain this clearly but I'm still a little bit confused about all this.

TL;DR

• I think putting the protocol in LOGSTASH_HOSTS makes Filebeat fail when using the Logstash output
• I think the port should be 5044 since that's the convention and the only way I could found to use Logstash from Filebeat was via the Beats input.
• It might be better to rename KIBANA_HOSTS to KIBANA_HOST
• I wonder if these variables can work with several hosts but I haven't tested it.