ELK 6 Dashboards and Customizations

Elastic Stack Beats
1

Hello All,

I am strugling to load visualizations and dashboards in ELK 6.x. This is running on Centos 7.

It seems from the docs that the load of winlogbeat dashboards come from the windows beat client. I cant get this to work. Below is the yml being used. When 'winlogbeat.exe setup --dashboards is executed, it fails and references localhost:9200 which is not specified in the yml.

All docs seem to point to a \scripts folder existing in the winlogbeat program files folder. This folder allegedly has import-dashboards.ps1. I have grabbed both 32-bit and 64-bit installers and this folder is not in the install archive.

Any idea what I am doing wrong?

winlogbeat.event_logs:

  • name: Application
  • name: Security
  • name: System

output.logstash:
hosts: ["brt1-elk02:5044"]

tags: ["dc"]

setup.kibana:
host: "brt1-elk02"
username: "elastic"
password: "!!!!!"

setup.dashboards.enabled: true

TIA!

2

winlogbeat.exe setup --dashboards is the right command to run.

During import first the version of Elasticsearch is checked. Based on your configuration you don't have an Elasticsearch instance. That's the error message you see I assume.

It's possible to skip this check by setting setup.dashboards.always_kibana to true. (https://www.elastic.co/guide/en/beats/filebeat/current/configuration-dashboards.html#_literal_setup_dashboards_always_kibana_literal)

3

This is the error I get after making the changes noted below to the winlogbeat.yml

ERROR:
C:\Program Files\winlogbeat>winlogbeat.exe setup --dashboards
Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Er
ror creating Kibana client: fail to get the Kibana version:HTTP GET request to /
api/status fails: fail to execute the HTTP GET request: Get http://localhost:560
1/api/status: dial tcp 127.0.0.1:5601: connectex: No connection could be made be
cause the target machine actively refused it.. Response: .

CONFIG:
winlogbeat.event_logs:

  • name: Application
  • name: Security
  • name: System

output.logstash:
hosts: ["brt1-elk02:5044"]

tags: ["dc"]

setup.kibana:
host: "brt1-elk02"
username: "elastic"
password: "********"

setup.dashboards.enabled: true
setup.dashboards.always_kibana: true
setup.dashboards.url: http://brt1-elk02

4

Are you sure your Kibana config is correct? Is setup.kibana.host is correct? To me it seems like the port number is missing.

5

Kibana is behind nginx... Port 80 => 5601. 5601 is not exposed.

The machine running winlogbeat in this case can resolve brt1-elk02 to 192.168.232.222

I am curious why in the config I have BRT1-ELK01 and error reports it cant find LOCALHOST

6

I am looking at the implementation right now. It seems to me that there is at least one problem. The first one is that if the host does not include a port number, it defaults to 5601. That's not right.
I am still looking why it says localhost instead of your URL. We should continue the discussion on Github as it's clearly a bug.

Please open an issue: https://github.com/elastic/beats/issues/new

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.