# Elastic Search not work with evebox **URL:** \ **Category:** SIEM\ **Tags:** painless\ **Created:** [March 14, 2024, 1:58am UTC](https://discuss.elastic.co/t/elastic-search-not-work-with-evebox/355353 "2024-03-14T01:58:46Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![jed](https://avatars.discourse-cdn.com/v4/letter/j/34f0e0/32.png) [@jed](https://discuss.elastic.co/u/jed)\ **Post date:** [March 14, 2024, 1:58am UTC](https://discuss.elastic.co/t/elastic-search-not-work-with-evebox/355353/1 "2024-03-14T01:58:46Z")
I just create Elastic on Debain server and and connect with Evebox to get logs from suricata but it not work. here is my configuration Elasticsearch ```auto # Use a descriptive name for your cluster: # cluster.name: suricata # # ------------------------------------ Node ------------------------------------ # # Use a descriptive name for the node: # #node.name: node-1 # # Add custom attributes to the node: # #node.attr.rack: r1 # # ----------------------------------- Paths ------------------------------------ # # Path to directory where to store the data (separate multiple locations by comma): # path.data: /var/lib/elasticsearch # # Path to log files: # path.logs: /var/log/elasticsearch # # ----------------------------------- Memory ----------------------------------- # # Lock the memory on startup: # #bootstrap.memory_lock: true ``` and here is kibana configuration ```auto =================== System: Kibana Server =================== # Kibana is served by a back end server. This setting specifies the port to use. server.port: 5601 # Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values. # The default is 'localhost', which usually means remote machines will not be able to connect. # To allow connections from remote users, set this parameter to a non-loopback address. server.host: "0.0.0.0" ``` and here is evebox configuration ```auto http: ## By default, EveBox binds to localhost. Uncomment this line to open ## it up. #host: "0.0.0.0" database: type: elasticsearch elasticsearch: url: http://192.168.32.149:9200 ## If using the Filebeat Suricata module, you'll probably want to ## change the index to "filebeat". index: logstash # If using the Filebeat Suricata module this needs to be true. #ecs: false ## If your Elasticsearch is using a self-signed certificate, ## you'll likely need to set this to true. ``` but it's get error When I run this command it's not work ```auto root@Suricata:/home/server# evebox server -e http:/192.168.32.149/:9200 2024-03-13 21:48:30 INFO evebox::version: This is EveBox version 0.18.0 (rev: 16bce96); x86_64-unknown-linux-musl 2024-03-13 21:48:30 INFO evebox::server::main: Using (discovered) data-directory /var/lib/evebox 2024-03-13 21:48:30 WARN evebox::elastic::client: Failed to get Elasticsearch version from http:/192.168.32.149/:9200, will try again: Reqwest(reqwest::Error { kind: Decode, source: Error("expected value", line: 1, column: 1) }) 2024-03-13 21:48:33 WARN evebox::elastic::client: Failed to get Elasticsearch version from http:/192.168.32.149/:9200, will try again: Reqwest(reqwest::Error { kind: Decode, source: Error("expected value", line: 1, column: 1) }) 2024-03-13 21:48:36 WARN evebox::elastic::client: Failed to get Elasticsearch version from http:/192.168.32.149/:9200, will try again: Reqwest(reqwest::Error { kind: Decode, source: Error("expected value", line: 1, column: 1) }) ``` please help me solve this problem. Best regards. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [March 14, 2024, 3:09am UTC](https://discuss.elastic.co/t/elastic-search-not-work-with-evebox/355353/2 "2024-03-14T03:09:26Z")
> [@jed](#): > > `root@Suricata:/home/server# evebox server -e http:/192.168.32.149/:9200` Is this a typo? The URL is maformatted, this is not a valid URL. ---
**Author:** ![jed](https://avatars.discourse-cdn.com/v4/letter/j/34f0e0/32.png) [@jed](https://discuss.elastic.co/u/jed)\ **Post date:** [March 14, 2024, 3:23am UTC](https://discuss.elastic.co/t/elastic-search-not-work-with-evebox/355353/3 "2024-03-14T03:23:52Z")
```auto WARN evebox::elastic::client: Failed to get Elasticsearch version from http://192.168.32.149:9200, will try again: Reqwest(reqwest::Error { kind: Request, url: Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv4(192.168.32.149)), port: Some(9200), path: "//", query: None, fragment: None }, source: hyper::Error(IncompleteMessage) }) ``` where can I put username and passsword sir and how can I fix this error ? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [March 14, 2024, 3:32am UTC](https://discuss.elastic.co/t/elastic-search-not-work-with-evebox/355353/4 "2024-03-14T03:32:30Z")
> [@jed](#): > > where can I put username and passsword sir > and how can I fix this error ? This seems an issue with evebox, I do not use it. You need to check their documentation. But, have you checked that your Elasticsearch is working without any issue? Can you access it using Kibana? ---
**Author:** ![jed](https://avatars.discourse-cdn.com/v4/letter/j/34f0e0/32.png) [@jed](https://discuss.elastic.co/u/jed)\ **Post date:** [March 14, 2024, 3:41am UTC](https://discuss.elastic.co/t/elastic-search-not-work-with-evebox/355353/5 "2024-03-14T03:41:44Z")
I just configuration to work with kibana ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b69f12f433c2d3cd3459df80de8c47a266b15f28.png) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [March 14, 2024, 3:47am UTC](https://discuss.elastic.co/t/elastic-search-not-work-with-evebox/355353/6 "2024-03-14T03:47:17Z")
This means that your Elasticsearch cluster is working. As mentioned, your error is related to evebox, you need to check their documentation for some hint on what could be the issue. I do not use this tool, so I'm not sure how it works. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 11, 2024, 3:47am UTC](https://discuss.elastic.co/t/elastic-search-not-work-with-evebox/355353/7 "2024-04-11T03:47:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.