看下node启动的日志，应该是配置出了问题，主节点要配置跨域可访问，还有确保各node的cluster.name要保持一致。

http.cors.enabled: true

http.cors.allow-origin: "*"

-E 后面加空格即可

可以看下这里，packebeat 没法抓取 loopback 的网卡

https://www.elastic.co/guide/en/beats/packetbeat/current/faq.html#packetbeat-loopback-interface

你的版本应该是6.x 了吧？教程里面是5.x，6.x 后不允许多个 output 了

是的，文中也给出解决办法了

If you require multiple outputs, you have the following options:

1. use the Logstash output and then use Logstash to pipe the events to multiple outputs

2. run multiple instances of the same Beat

If you used the file or console outputs for debugging purposes, in addition to the main output, we recommend using the -d "publish" option which logs the published events in the Filebeat logs.

我这里的数据是自己测试的，你不需要管这些数据，这个实例是为了抓取 production 集群的查询语句的，和数据没有关系