Can't setup kibana dashboards for Beats

Elastic Stack Beats
1

I want to send my data from beats to elasticsearch via logstash, also I want to configure the kibana dashboards for the same

So, in beats config, I have only added hosts for kibana and logstash. After doing this I can't set up my dashboard

Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch http://someprivateip:5044: Get http://someprivateip:5044: read tcp 192.168.1.159:58162->someprivateip:5044: wsarecv: An existing connection was forcibly closed by the remote host.]

However, the ports are already opened in my server

root@soc:~/iptables# netstat -tunlpa | grep 5044
tcp6       0      0 :::5044                 :::*                    LISTEN      5100/java           
root@soc:~/iptables# netstat -tunlpa | grep 9600
tcp6       0      0 :::9600                 :::*                    LISTEN      5100/java           
root@soc:~/iptables#

My beats configuration for logstash

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
}
2

Ok this was because of a bug (i havent commeneted elasticsearch configuration in output).

So now after fixing it and running auditbeat.exe setup, I am getting following error

Exiting: Index management requested but the Elasticsearch output is not configured/enabled
3

Hey @tbhaxor,

To configure dashboards, Beats only need access to Kibana, for that you can run auditbeat setup --dashboards.

For other steps of the setup, Beats need direct access to Elasticsearch, if you want to setup also ILM you will need to run at least once auditbeat setup with auditbeat configured with Elasticsearch as output.

If nothing works for you, could you please share your auditbeat configuration, and the version you are using?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.