# Exiting: error connecting to Kibana: fail to get the Kibana version: fail to parse kibana version (): passed version is not semver:

**URL:** <https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 16, 2024, 9:25am UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450 "2024-02-16T09:25:17Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![alsoGAMER](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alsogamer/32/131813_2.png) [@alsoGAMER](https://discuss.elastic.co/u/alsoGAMER)\
**Post date:** [February 16, 2024, 9:25am UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/1 "2024-02-16T09:25:17Z")

</div>

I'm trying to setup an ELK instance to use as a winlogbeat output, and even though both the ELK stack and winlogbeat versions are the exact same, I'm getting this cryptic error:

```auto
Exiting: error connecting to Kibana: fail to get the Kibana version: fail to parse kibana version (): passed version is not semver:

```

I've linked both a full winlogbeat output when running `winlogbeat setup -e` and my ELK stack env file.

Log: [winlogbeat.txt · GitHub](https://gist.github.com/alsoGAMER/f437861142821858acfe42c84b0eff23)  
env: [.env · GitHub](https://gist.github.com/alsoGAMER/bd6c41e5bfabebe5ddf30b8916c658e7)

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 16, 2024, 1:23pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/2 "2024-02-16T13:23:49Z")

</div>

I generally see this error when the kibana URL provided is a valid address with something listening but it's not Kibana or it's https but kibana is actually not available over https.

Can you try running both

`curl -u "user:password" https://192.168.1.103:5601/api/status`

`curl -u "user:password" http://192.168.1.103:5601/api/status`

Replacing user and password with your actual kibana username and password.

And letting me know what the result is of each?

Can you also share your beat yml config?

---

<div class="post-metadata">

**Author:** ![alsoGAMER](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alsogamer/32/131813_2.png) [@alsoGAMER](https://discuss.elastic.co/u/alsoGAMER)\
**Post date:** [February 16, 2024, 2:30pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/3 "2024-02-16T14:30:31Z")

</div>

curl w/ssl (passing `--ignore` too) returns the standard kibana json response ([kibanastatus.json · GitHub](https://gist.github.com/alsoGAMER/c620f72bb153d6cae92a320d59f5baa7))  
curl without ssl returns: `curl: (52) Empty reply from server`

Here the kibana yml config file: [kibana.yml · GitHub](https://gist.github.com/alsoGAMER/8477b096d856b7e85e417ba64969566a)

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 16, 2024, 2:34pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/4 "2024-02-16T14:34:28Z")

</div>

Can you share the winlogbeat.yml?

---

<div class="post-metadata">

**Author:** ![alsoGAMER](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alsogamer/32/131813_2.png) [@alsoGAMER](https://discuss.elastic.co/u/alsoGAMER)\
**Post date:** [February 16, 2024, 3:11pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/5 "2024-02-16T15:11:22Z")

</div>

There you go [winlogbeat.yml · GitHub](https://gist.github.com/alsoGAMER/9ce55115a416bc036e839fe97471a8cb)

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 16, 2024, 3:24pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/6 "2024-02-16T15:24:04Z")

</div>

Can you confirm you ran these from the server running Filebeat?

Can you restart the kibana server and try to run Filebeat again?

Can you try running winlogbeat with `winlogbeat setup -e -d '*'` and share the full output?

---

<div class="post-metadata">

**Author:** ![alsoGAMER](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alsogamer/32/131813_2.png) [@alsoGAMER](https://discuss.elastic.co/u/alsoGAMER)\
**Post date:** [February 16, 2024, 3:35pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/7 "2024-02-16T15:35:06Z")

</div>

Filebeat is not part of my deployment.  
There's just kibana + elastic + logstash.

Here's the log [winlogbeat.json · GitHub](https://gist.github.com/alsoGAMER/40d5ad3a96c0f9d460c3daf069777bde) (just the server ip changed cause dhcp)

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 16, 2024, 3:47pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/8 "2024-02-16T15:47:21Z")

</div>

Did you perform the curl command from the device running winlogbeat? I assume no?

Can you try to access the previous urls in a browser from the device running winlogbeat or use invoke-webrequest from a power shell session?

---

<div class="post-metadata">

**Author:** ![alsoGAMER](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alsogamer/32/131813_2.png) [@alsoGAMER](https://discuss.elastic.co/u/alsoGAMER)\
**Post date:** [February 16, 2024, 3:52pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/9 "2024-02-16T15:52:38Z")

</div>

Yeah I performed it on my windows client, just through WSL, and yes I can access all of them just fine.

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 16, 2024, 4:14pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/10 "2024-02-16T16:14:15Z")

</div>

The error appears to indicate that winlogbeat is getting some sort of json response from kibana but that it is not finding any value for version in the json response.

Are you fronting kibana with a proxy or is there any other infrastructure between the Windows box and the kibana server?

Can you try setting up another beat on another device and see if you can perform kibana setup from that device?

---

<div class="post-metadata">

**Author:** ![alsoGAMER](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alsogamer/32/131813_2.png) [@alsoGAMER](https://discuss.elastic.co/u/alsoGAMER)\
**Post date:** [February 16, 2024, 4:16pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/11 "2024-02-16T16:16:52Z")

</div>

The whole ELK stack is deployed in a dedicated VM as a docker stack, using [GitHub - sherifabdlnaby/elastdocker: 🐳 Elastic Stack (ELK) v8+ on Docker with Compose. Pre-configured out of the box to enable Logging, Metrics, APM, Alerting, ML, and SIEM features. Up with a Single Command.](https://github.com/sherifabdlnaby/elastdocker), and there's no proxy in-between.

I already tried that days ago and I was getting the same error.

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 16, 2024, 4:17pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/12 "2024-02-16T16:17:35Z")

</div>

Can you add `setup.kibana.protocol: "https"` to your winlogbeat config.

> **[Configure the Kibana endpoint | Filebeat Reference \[8.12\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/setup-kibana-endpoint.html)**

> When a node is defined as an IP:PORT, the scheme and path are taken from the setup.kibana.protocol and setup.kibana.path config options.

---

<div class="post-metadata">

**Author:** ![alsoGAMER](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alsogamer/32/131813_2.png) [@alsoGAMER](https://discuss.elastic.co/u/alsoGAMER)\
**Post date:** [February 16, 2024, 4:20pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/13 "2024-02-16T16:20:19Z")

</div>

Done, still the same issue.

Though documentation in the config says: `# Scheme and port can be left out and will be set to the default (http and 5601)`, this is why I didn't add `setup.kibana.protocol:`

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 16, 2024, 4:27pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/14 "2024-02-16T16:27:44Z")

</div>

> Scheme can be left out if you do not specify a port and if are using http.
> 
> If you specify a port then I do believe you need to specify the scheme.

Actually that's wrong. The documentation does say "However, if you specify a URL for host, the value of protocol is overridden by whatever scheme you specify in the URL." So your initial configuration was fine.

Im not able to reproduce this with a kibana install following the Elastic installation guide so if you are testing with the kibana scheme set to https in the winlogbeat config it might make sense to file an issue with that elastic quick start project on GitHub to see if they have done anything that would inhibit winlogbeat setting up Kibana.

You could also try to setup an SSL proxy so you can inspect the request winlogbeat is making and the exact contents of the response which might help figuring out what's going on.

You also could just use the cli to export the dashboards and index patterns and manually import them as kibana setup is optional. [Winlogbeat command reference | Winlogbeat Reference [8.12] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/command-line-options.html#export-command)

---

<div class="post-metadata">

**Author:** ![alsoGAMER](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alsogamer/32/131813_2.png) [@alsoGAMER](https://discuss.elastic.co/u/alsoGAMER)\
**Post date:** [February 16, 2024, 4:40pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/15 "2024-02-16T16:40:10Z")

</div>

> [@strawgate](#):
>
> Im not able to reproduce this with a kibana install following the Elastic installation guide so if you are testing with the kibana scheme set to https in the winlogbeat config it might make sense to file an issue with that elastic quick start project on GitHub to see if they have done anything that would inhibit winlogbeat setting up Kibana.

I've opened a bug report to the Github project ([Exiting: error connecting to Kibana: fail to get the Kibana version: fail to parse kibana version (): passed version is not semver: · Issue #112 · sherifabdlnaby/elastdocker · GitHub](https://github.com/sherifabdlnaby/elastdocker/issues/112))

> [@strawgate](#):
>
> You could also try to setup an SSL proxy so you can inspect the request winlogbeat is making and the exact contents of the response which might help figuring out what's going on.

I'll try doing that on Monday and update this thread.

> [@strawgate](#):
>
> You also could just use the cli to export the dashboards and index patterns and manually import them as kibana setup is optional. [Winlogbeat command reference | Winlogbeat Reference [8.12] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/command-line-options.html#export-command)

I'd prefer to use kibana.

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 16, 2024, 4:42pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/16 "2024-02-16T16:42:19Z")

</div>

You can still use kibana, all this setup does is a one time import of the default winlogbeat dashboard.

You could also try setting something like `logging.verbose: true` in the kibana.yml and see if you can get kibana to log the requests from winlogbeat and it's corresponding responses. That exact setting might be deprecated so if you go this route and have trouble let me know and I can go digging.

---

<div class="post-metadata">

**Author:** ![alsoGAMER](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alsogamer/32/131813_2.png) [@alsoGAMER](https://discuss.elastic.co/u/alsoGAMER)\
**Post date:** [February 16, 2024, 4:49pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/17 "2024-02-16T16:49:20Z")

</div>

> [@strawgate](#):
>
> You could also try setting something like `logging.verbose: true` in the kibana.yml and see if you can get kibana to log the requests from winlogbeat and it's corresponding responses. That exact setting might be deprecated so if you go this route and have trouble let me know and I can go digging.

`FATAL Error: [config validation of [logging].verbose]: definition for this key is missing`

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 16, 2024, 4:55pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/18 "2024-02-16T16:55:19Z")

</div>

They error seems to imply this won't work either but can you try

```auto
logging:
  root:
    level: debug

```

From

> **[Logging settings in Kibana | Kibana Guide \[8.12\] | Elastic](https://www.elastic.co/guide/en/kibana/current/logging-settings.html)**

---

<div class="post-metadata">

**Author:** ![alsoGAMER](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alsogamer/32/131813_2.png) [@alsoGAMER](https://discuss.elastic.co/u/alsoGAMER)\
**Post date:** [February 16, 2024, 5:01pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/19 "2024-02-16T17:01:47Z")

</div>

Done.  
winlogbeats is now displaying a different error

```auto
{"log.level":"error","@timestamp":"2024-02-16T17:58:53.655+0100","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1312},"message":"Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to https://192.168.1.119:5601/api/status fails: status=503. Response: {\"status\":{\"overall\":{\"level\":\"unavailable\"}}}","service.name":"winlogbeat","ecs.version":"1.6.0"}
Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to https://192.168.1.119:5601/api/status fails: status=503. Response: {"status":{"overall":{"level":"unavailable"}}}

```

and from the kibana logs I'm getting `[2024-02-16T17:00:37.520+00:00][DEBUG][http.server.response] GET /api/status 503 3ms - 46.0B`  
along with `[2024-02-16T17:00:43.283+00:00][DEBUG][elasticsearch.query.data] [ConnectionError]: unable to verify the first certificate`

I'll OOO till Monday though

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 16, 2024, 5:10pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450/20 "2024-02-16T17:10:29Z")

</div>

Ok that looks like an issue with kibana not trusting the elasticsearch certificate.

[Next page](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-fail-to-parse-kibana-version-passed-version-is-not-semver/353450.md?page=2)