# Connect kibana to Elasticsearch after changes made

**URL:** <https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518>\
**Category:** Kibana\
**Created:** [February 14, 2023, 9:23pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518 "2023-02-14T21:23:13Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [February 14, 2023, 9:23pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/1 "2023-02-14T21:23:13Z")

</div>

Hello!

My kibana doesnt talk to Elasticsearch after changes are made in elasticsearch config

Some history:  
installed ELK on one host and filebeat on another one.

Started elasticsearch, started kibana, started logstash  
Connected to kibana with browser and put enrollment token ( automatically generated), connected with user: elastic and password, everything works.

Configured filebeat and logstash, they are able to communicate now. Filebeat sends events, logstash receives them.

To provide insecure communication between logstash and elasticsearch made changes in elasticsearch.yml. For the moment it looks like this

elasticsearch.yml

```auto
cluster.name: my-application
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.port: 9200

xpack.security.enabled: false
xpack.security.enrollment.enabled: false
xpack.security.http.ssl:
  enabled: false

xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
cluster.initial_master_nodes: ["dlx-prd-dal-search-11-p.int.sparkred.com"]

http.host: 0.0.0.0

```

The settings I've changed:  
xpack.security.enabled: false  
xpack.security.enrollment.enabled: false  
xpack.security.http.ssl:  
enabled: false

They used to be - true

My kibana.yml

```auto
server.port: 5601
server.host: "0.0.0.0"

logging:
  appenders:
    file:
      type: file
      fileName: /var/log/kibana/kibana.log
      layout:
        type: json
  root:
    appenders:
      - default
      - file
pid.file: /run/kibana/kibana.pid

elasticsearch.hosts: ['https://10.142.77.174:9200']
elasticsearch.serviceAccountToken: AAEAAWVsYXN0aWMva2liYW5hL2Vucm9sbC1wcm9jZXNzLXRva2VuLTE2NjgwMzIzMzExMDU6ZVhiMVFPRFBUOUtBSGhtZkNhbjgyZw
elasticsearch.ssl.certificateAuthorities: [/var/lib/kibana/ca_1668032331523.crt]
xpack.fleet.outputs: [{id: fleet-default-output, name: default, is_default: true, is_default_monitoring: true, type: elasticsearch, hosts: ['https://10.142.77.174:9200'], ca_trusted_fingerprint: e7b4eb1476cdbd2606e2eade41373a0ce52305b3313efe082cef0676e2ada4a7}]

```

I believe I need to make some changes in xpack.fleet.outputs line of kibana.  
Is this right? What changes should I make to provide access kibana to elasticsearch again?

I don't care for security for now. This setup on testing environment to get familiar with ELK  
Thank you for your help.

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [February 14, 2023, 9:37pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/2 "2023-02-14T21:37:02Z")

</div>

I forgot to mention - when I'm trying to [http://IP:5601](http://IP:5601)  
I have a message "Kibana server is not ready yet."  
In kibana.log I can see lines like this:

```auto
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.4.0"},"@timestamp":"2023-02-14T15:32:11.180-06:00","message":"Unable to retrieve version information from Elasticsearch nodes. write EPROTO 47776760881024:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:332:\n","log":{"level":"ERROR","logger":"elasticsearch-service"},"process":{"pid":18927},"trace":{"id":"d23526847b6ba234f6fe7e55c64d0f73"},"transaction":{"id":"5f094a5e56756e96"}}

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 14, 2023, 10:50pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/3 "2023-02-14T22:50:15Z")

</div>

> [@vassiliy.vins](#):
>
> The settings I've changed:  
> xpack.security.enabled: false  
> xpack.security.enrollment.enabled: false  
> xpack.security.http.ssl:  
> enabled: false

If you disabled all of these then you need to update Kibana to remove authentication and TLS.

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [February 14, 2023, 10:51pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/4 "2023-02-14T22:51:14Z")

</div>

Update, you mean reinstall?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 14, 2023, 10:51pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/5 "2023-02-14T22:51:39Z")

</div>

No, you need to change the settings.

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [February 14, 2023, 10:52pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/6 "2023-02-14T22:52:05Z")

</div>

yes, that was my question - which settings?

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [February 14, 2023, 10:53pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/7 "2023-02-14T22:53:07Z")

</div>

my kibana.yml is provided.. which settings I should change?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 14, 2023, 10:53pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/8 "2023-02-14T22:53:34Z")

</div>

> [@vassiliy.vins](#):
>
> ```auto
> elasticsearch.hosts: ['https://10.142.77.174:9200']
> elasticsearch.serviceAccountToken: AAEAAWVsYXN0aWMva2liYW5hL2Vucm9sbC1wcm9jZXNzLXRva2VuLTE2NjgwMzIzMzExMDU6ZVhiMVFPRFBUOUtBSGhtZkNhbjgyZw
> elasticsearch.ssl.certificateAuthorities: [/var/lib/kibana/ca_1668032331523.crt]
> 
> ```

These ones, remove TLS and auth.

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [February 14, 2023, 10:55pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/9 "2023-02-14T22:55:39Z")

</div>

you mean to comment out the last 2 lines in the output? what about  
xpack.fleet.outputs: ? need to change smth in this line?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 15, 2023, 12:27am UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/10 "2023-02-15T00:27:24Z")

</div>

Yes comment out of the fleet line AND change to  
`http` not `https`

`elasticsearch.hosts: ['http://10.142.77.174:9200']`  
`..........................^`

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [February 15, 2023, 12:34am UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/11 "2023-02-15T00:34:27Z")

</div>

OK, thnx.. will apply tomorrow and let you know

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [February 15, 2023, 3:23pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/12 "2023-02-15T15:23:40Z")

</div>

yes, I have access to kibana interface thank you for your help  
The only question I have - what "fleet" does?  
I've commented it out - will I be able to see events(logs) in kibana?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 15, 2023, 3:28pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/13 "2023-02-15T15:28:30Z")

</div>

Hi @vassiliy.vins apologies I have lost track of what you are trying to accomplish

Fleet Manages Agents, and will not work without security enabled

And Yes you can still send data to elastic with Beats, Agents, and any other method you chose since elsasticsearch as an HTTP(S) REST API endpoint

> **[Set up Fleet Server | Fleet and Elastic Agent Guide \[8.6\] | Elastic](https://www.elastic.co/guide/en/fleet/current/fleet-server.html#_what_is_fleet_server)**

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [February 15, 2023, 3:33pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/15 "2023-02-15T15:33:04Z")

</div>

I'm trying to reach very basic setup - filebeat on remote host, ELK on server and see logs from remote host in Kibana.. That's what I'm trying to reach

security is not on the first place for now

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [February 15, 2023, 3:41pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/16 "2023-02-15T15:41:57Z")

</div>

looks like we can close this ticket, thank you for your help

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 15, 2023, 3:53pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/17 "2023-02-15T15:53:33Z")

</div>

> [@vassiliy.vins](#):
>
> I'm trying to reach very basic setup - filebeat on remote host, ELK on server and see logs from remote host in Kibana.. That's what I'm trying to reach
> 
> security is not on the first place for now

You could have just used the default setting with security enabled by default than simply set the SSL verification to none for the beats.

You can also disable all security which it appears you are doing, then beats will use HTTP and no authentication

Unfortunately seems like you started 1 way and then changed

Both are valid... by default Elastic enables security because it is a data store, so you are actually going against the grain a bit...

here is a [post](https://discuss.elastic.co/t/filebeat-on-local-laptop-does-not-talk-to-the-elasticsearch-also-on-local-laptop-dial-tcp-1-connect-cannot-assign-requested-address/317145/5) on how to disable security

If you want a docker compose that creates an elastic and kibana with no security I have one....

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [February 15, 2023, 4:00pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/18 "2023-02-15T16:00:15Z")

</div>

Thank you, Stephen  
My first intention was - to have default security enabled, but I met some problems - that some parts of environments were not able to communicate to each other.  
So I started to disable security features to have at least something working and see logs in kibana.

For me right now more important to see logs in kibana and make some filtering..

As I said after that I will add ssl back and so on

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2023, 4:00pm UTC](https://discuss.elastic.co/t/connect-kibana-to-elasticsearch-after-changes-made/325518/19 "2023-03-15T16:00:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.