ELK basic config

Elastic Stack Elasticsearch
1

Hey Guys,

I am turning to this forum since I can't get to the bottom of it. I installed ELK Stack on CentOS7, however I do not seem to be able to make my configuration working with my network. I am trying to get Winlogbeat to connect and I can't, I get an error that it cannot connect to the IP:9200.

I have added the ports to Firewalld, however doesn't seem to be the issue.

Thanks,

elasticsearch.yml

---------------------------------- Network -----------------------------------

Set the bind address to a specific IP (IPv4 or IPv6):

network.host: localhost

-----------------------------------------------------------------------------------

kibana.yml

Server config for Kibana

server.port: 5601
server.host: 192.168.131.133
elasticsearch.hosts: [http://192.168.131.133:9200]

-----------------------------------------------------------------------------------

winlogbeat.yml

output:
elasticsearch:
hosts: ["http://192.168.131.133:9200"]

-----------------------------------------------------------------------------------

2

This is a single server and you have elastic listening on localhost?

As root, issue: netstat -anp | grep LISTEN | grep java

You'll probably see:
tcp6 0 0 127.0.0.1:9200 :::* LISTEN 202326/java

So elasticsearch port 9200 isn't listening on the 192.168.131.133 address.

One fix may be to change elasticsearch to:
network.host: "0"

To listen on all network interfaces, or change your clients to reference 127.0.0.1:9200.

3

Thanks for the answer. I tried to change network.host: localhost to "0", however the elasticsearch service is failing. I will dig to see if I can have the answer.

When grepping for Java, nothing comes. I verified that java is indeed installed with version 1.8.0 openjdk.

4

Yes, the port won't be LISTEN unless the service is running.

5

I will ask... I read on ELK website that other configs are required when ELK is not used in Localhost mode. Looks like it is in elasticsearch.yml... If you do not mind, could you share a 'working' config file of ELK ? I mean by that what param you are using to make it work.

6

Does that make any sens ?

-------- Elasticsearch --------

--- Cluster ---

cluster.name: ELK-CLUSTER

--- Node ---

node.name: ELK-PROD-01

--- Path ---

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch

--- Network ---

network.host: IPAddress

-------------------------------

///////////////////////////////////
\\\\\\\\\\\\\\\\\\

-------- Kibana --------

--- URL ---

elasticsearch.hosts: ["IPAddress:9200"]

------------------------

7

I did notice my 7.2 elasticsearch has network.host: 0.0.0.0

These are from a test system with almost no config changes.

elasticsaerch.yml:

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: rugen-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /var/lib/elasticsearch
#
# Path to log files:
#
path.logs: /var/log/elasticsearch
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["rugen-1"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true

From host 192.128.1.54

$ curl http://192.168.1.15:9200
{
  "name" : "rugen-1",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "fDa3B0jEQjSahgk_CxV7Kg",
  "version" : {
    "number" : "7.2.0",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "508c38a",
    "build_date" : "2019-06-20T15:54:18.811730Z",
    "build_snapshot" : false,
    "lucene_version" : "8.0.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

Kibana is the defaults for host:

#The URLs of the Elasticsearch instances to use for all your queries.
#elasticsearch.hosts: ["http://localhost:9200"]
8

on elasticsearch.yml file

network.host: <ip_address> ## and make sure you have ip address resolve to name, i.e in dns. if no dns is used then put this in to /etc/hosts file
and
http.port: 9200

on kibana.yml
server.port:5601
server.host: "systemname"
server.name: "system.name"
elasticsearch.hosts: ["http://:9200"]

try that

9

So it works now on Elasticsearch, thanks to your help. I can use CURL to my IPaddress:9200 or my Hostname:9200.

Now I am tackling the logging part, thanks for you help !

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.