Error connecting to Kibana: fail to get the Kibana version

Elastic Stack Kibana
1

I get an error after trying to load the dashboards from Filebeat into Kibana.

filebeat setup --dashboards
Loading dashboards (Kibana must be running and reachable)
Exiting: error connecting to Kibana: fail to get the Kibana version: fail to parse kibana version (): passed version is not semver:

Kibana is running and I can also see the logs populate the Discover page in it.

Kibana is on version 8.17.2 and Filebeat is 8.17.3, so they should be compatible.

Filebeat and the ELK-Stack are running on the same Ubuntu 24 host. Kibana, Logstash and Elasticsearch are running in Docker containers each, while Filebeat was installed via

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.17.4-amd64.deb
sudo dpkg -i filebeat-8.17.4-amd64.deb

In filebeat.yml I currently have nothing in the Kibana section because the official Filebeat Quick Start Guide says If you plan to use our pre-built Kibana dashboards, configure the Kibana endpoint. Skip this step if Kibana is running on the same host as Elasticsearch.

Please let me know if I should provide more information :folded_hands:

2

In case anyone stumbles upon the same problem: It worked after I added the credentials in the Kibana part of filebeat.yml. Now I can see the dashboards, but they don't show anything ("No results found") even though I can see the logs on the Discover page.

3

Did you run

filebeat setup -e

I always suggest that and that is part of the quickstart as well That loads all the necessary artifacts like templates (schema) etc...

When you run...

filebeat setup --dashboards

That only loads the dashboards and will often lead to things not working

You might need to "clean up" and try again...

4

Thanks for the reply. I don't think i ran filebeat setup -e - I probably thought that filebeat setup --dashboards would suffice.
Can you point me in the right direction regarding "cleaning up"? Would it be enough to delete the indices that were created up until now?

5

Yes, deleting that should do it on the elasticsearch side.

typically with versions Beats version <= Stack Version so technically you should run filebeat 8.17.2

Curious Why you are using Logstash ... that can complicate things.... do you have a reason too

instead of

Filebeat -> Elasticsearch

6

It was a requirement from higher up... I guess the idea is to "future-proof" the setup because more and more data sources will be added gradually.

I tried filebeat setup -e but got this error:

{"log.level":"error","@timestamp":"2025-04-16T11:17:16.220+0200","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1594},"message":"Exiting: index management requested but the Elasticsearch output is not configured/enabled","service.name":"filebeat","ecs.version":"1.6.0"}
Exiting: index management requested but the Elasticsearch output is not configured/enabled

Do I have to change the output in filebeat.yml to Elasticsearch temporarily and then change back to Logstash afterwards, or is there another way?

7

Yes.

Also if you are using

filebeat > Logstash> Elasticsearch

The logstash conf needs to be correct

And this

8

I followed the steps provided by @stephenb and then edited the logstash.conf file as outlined in the second link above. I can now see the dashboards and they seem to work correctly. Thanks again!

1 Like