# ELK basic config

**URL:** <https://discuss.elastic.co/t/elk-basic-config/196411>\
**Category:** Elasticsearch\
**Created:** [August 22, 2019, 9:38pm UTC](https://discuss.elastic.co/t/elk-basic-config/196411 "2019-08-22T21:38:28Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![NewmazN24](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\
**Post date:** [August 22, 2019, 9:38pm UTC](https://discuss.elastic.co/t/elk-basic-config/196411/1 "2019-08-22T21:38:29Z")

</div>

Hey Guys,

I am turning to this forum since I can't get to the bottom of it. I installed ELK Stack on CentOS7, however I do not seem to be able to make my configuration working with my network. I am trying to get Winlogbeat to connect and I can't, I get an error that it cannot connect to the IP:9200.

I have added the ports to Firewalld, however doesn't seem to be the issue.

Thanks,

**elasticsearch.yml**

# ---------------------------------- Network -----------------------------------

# 

# Set the bind address to a specific IP (IPv4 or IPv6):

# 

network.host: localhost

# -----------------------------------------------------------------------------------

**kibana.yml**

# Server config for Kibana

server.port: 5601  
server.host: 192.168.131.133  
elasticsearch.hosts: [[http://192.168.131.133:9200](http://192.168.131.133:9200)]

# -----------------------------------------------------------------------------------

**winlogbeat.yml**

output:  
elasticsearch:  
hosts: ["[http://192.168.131.133:9200](http://192.168.131.133:9200)"]

# -----------------------------------------------------------------------------------

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [August 22, 2019, 11:02pm UTC](https://discuss.elastic.co/t/elk-basic-config/196411/2 "2019-08-22T23:02:03Z")

</div>

This is a single server and you have elastic listening on localhost?

As root, issue: netstat -anp | grep LISTEN | grep java

You'll probably see:  
tcp6 0 0 127.0.0.1:9200 :::\* LISTEN 202326/java

So elasticsearch port 9200 isn't listening on the 192.168.131.133 address.

One fix may be to change elasticsearch to:  
network.host: "0"

To listen on all network interfaces, or change your clients to reference 127.0.0.1:9200.

---

<div class="post-metadata">

**Author:** ![NewmazN24](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\
**Post date:** [August 23, 2019, 12:40pm UTC](https://discuss.elastic.co/t/elk-basic-config/196411/3 "2019-08-23T12:40:49Z")

</div>

Thanks for the answer. I tried to change network.host: localhost to "0", however the elasticsearch service is failing. I will dig to see if I can have the answer.

When grepping for Java, nothing comes. I verified that java is indeed installed with version 1.8.0 openjdk.

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [August 23, 2019, 4:50pm UTC](https://discuss.elastic.co/t/elk-basic-config/196411/4 "2019-08-23T16:50:08Z")

</div>

Yes, the port won't be LISTEN unless the service is running.

---

<div class="post-metadata">

**Author:** ![NewmazN24](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\
**Post date:** [August 23, 2019, 5:05pm UTC](https://discuss.elastic.co/t/elk-basic-config/196411/5 "2019-08-23T17:05:03Z")

</div>

I will ask... I read on ELK website that other configs are required when ELK is not used in Localhost mode. Looks like it is in elasticsearch.yml... If you do not mind, could you share a 'working' config file of ELK ? I mean by that what param you are using to make it work.

---

<div class="post-metadata">

**Author:** ![NewmazN24](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\
**Post date:** [August 23, 2019, 7:51pm UTC](https://discuss.elastic.co/t/elk-basic-config/196411/6 "2019-08-23T19:51:06Z")

</div>

Does that make any sens ?

# -------- Elasticsearch --------

# --- Cluster ---

cluster.name: ELK-CLUSTER

# --- Node ---

node.name: ELK-PROD-01

# --- Path ---

path.data: /var/lib/elasticsearch  
path.logs: /var/log/elasticsearch

# --- Network ---

network.host: IPAddress

# -------------------------------

///////////////////////////////////  
\\\\\\\\\\\\\\\\\\

# -------- Kibana --------

# --- URL ---

elasticsearch.hosts: ["IPAddress:9200"]

# ------------------------

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [August 24, 2019, 5:07pm UTC](https://discuss.elastic.co/t/elk-basic-config/196411/7 "2019-08-24T17:07:52Z")

</div>

I did notice my 7.2 elasticsearch has network.host: 0.0.0.0

These are from a test system with almost no config changes.

elasticsaerch.yml:

```
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: rugen-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /var/lib/elasticsearch
#
# Path to log files:
#
path.logs: /var/log/elasticsearch
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["rugen-1"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true

```

From host 192.128.1.54

```
$ curl http://192.168.1.15:9200
{
  "name" : "rugen-1",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "fDa3B0jEQjSahgk_CxV7Kg",
  "version" : {
    "number" : "7.2.0",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "508c38a",
    "build_date" : "2019-06-20T15:54:18.811730Z",
    "build_snapshot" : false,
    "lucene_version" : "8.0.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

```

Kibana is the defaults for host:

```
#The URLs of the Elasticsearch instances to use for all your queries.
#elasticsearch.hosts: ["http://localhost:9200"]
```

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 24, 2019, 5:33pm UTC](https://discuss.elastic.co/t/elk-basic-config/196411/8 "2019-08-24T17:33:30Z")

</div>

on elasticsearch.yml file

network.host: \<ip\_address\> ## and make sure you have ip address resolve to name, i.e in dns. if no dns is used then put this in to /etc/hosts file  
and  
http.port: 9200

on kibana.yml  
server.port:5601  
server.host: "systemname"  
server.name: "system.name"  
elasticsearch.hosts: ["http://:9200"]

try that

---

<div class="post-metadata">

**Author:** ![NewmazN24](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\
**Post date:** [August 26, 2019, 1:43pm UTC](https://discuss.elastic.co/t/elk-basic-config/196411/9 "2019-08-26T13:43:23Z")

</div>

So it works now on Elasticsearch, thanks to your help. I can use CURL to my IPaddress:9200 or my Hostname:9200.

Now I am tackling the logging part, thanks for you help !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 23, 2019, 1:43pm UTC](https://discuss.elastic.co/t/elk-basic-config/196411/10 "2019-09-23T13:43:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.