# Filebeat dashboard create failing

**URL:** https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699
**Category:** Elasticsearch
**Created:** [October 15, 2019, 5:56pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699 "2019-10-15T17:56:40Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![hermlam](https://avatars.discourse-cdn.com/v4/letter/h/8797f3/32.png) [@hermlam](https://discuss.elastic.co/u/hermlam)
#### Post date: [October 15, 2019, 5:56pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699/1 "2019-10-15T17:56:40Z")

</div>

Hi,  
I installed Elastic and Kibana on one server and Filebeat on another. Running file except for 'sudo filebeat setup -e'

I changed 'localhost' to the right IP in elastic, kibana and filebeat yml's but still this error is occurring:  
Thanks,  
Herman

2019-10-15T19:32:07.462+0200 INFO kibana/client.go:117 Kibana url: [http://localhost:5601](http://localhost:5601)  
2019-10-15T19:32:07.464+0200 ERROR instance/beat.go:878 Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to [http://localhost:5601/api/status](http://localhost:5601/api/status) fails: fail to execute the HTTP GET request: Get [http://localhost:5601/api/status:](http://localhost:5601/api/status:) dial tcp 127.0.0.1:5601: connect: connection refused. Response: .  
Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to [http://localhost:5601/api/status](http://localhost:5601/api/status) fails: fail to execute the HTTP GET request: Get [http://localhost:5601/api/status:](http://localhost:5601/api/status:) dial tcp 127.0.0.1:5601: connect: connection refused. Response: .

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [October 16, 2019, 4:46am UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699/2 "2019-10-16T04:46:47Z")

</div>

In `filebeat.yml` there is a sectionfor elasticsearch and a section for kibana did you set both of them to point to their respective hosts. The error above seems to indicate that in the `filebeat.yml` the kibana settings are still pointing to `http://localhost:5601` perhaps it should be pointing elsewhere?

See [here](https://www.elastic.co/guide/en/beats/filebeat/current/setup-kibana-endpoint.html):

---

<div class="post-metadata">

### Author: ![hermlam](https://avatars.discourse-cdn.com/v4/letter/h/8797f3/32.png) [@hermlam](https://discuss.elastic.co/u/hermlam)
#### Post date: [October 16, 2019, 5:33am UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699/3 "2019-10-16T05:33:43Z")

</div>

Hi Stephen,  
Thanks. Both Elastic and Kibana sections contain the IP of the Elastic server, so the problem must be somewhere else, but I can't find it.

Herman

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [October 16, 2019, 11:07pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699/4 "2019-10-16T23:07:44Z")

</div>

Can you post your filebeat.yml and format it with the `</>` if you wish, we can take a quick look.

---

<div class="post-metadata">

### Author: ![hermlam](https://avatars.discourse-cdn.com/v4/letter/h/8797f3/32.png) [@hermlam](https://discuss.elastic.co/u/hermlam)
#### Post date: [October 17, 2019, 7:41am UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699/7 "2019-10-17T07:41:11Z")

</div>

Hi Stephen  
filebeat.yml: (comments shoretened to avoid max 7000)

\</\>### Filebeat Configuration Example ###

\</\># This file is an example cghlighting only the most common  
\</\># options. The filebeat.reference.yml file from the same directory contains all the  
\</\># supported option can use it as a reference.  
\</\># You can finduration reference here:  
\</\># [https://wwwat/index.html](https://wwwat/index.html)

\</\># For more available modules and options, please see the filebeat.reference.yml sample  
\</\># configuration file.

\</\>#========= Filebeat inputs ===========

filebeat.inputs:

\</\># Each - is e set at the input level, so  
\</\># you can ous configurations.  
\</\># Below ar configurations.

- type: log

\</\>#=========== Filebeat modules ===========

filebeat.config.modules:  
\</\># Glob pattern for configuration loading  
path: ${path.config}/modules.d/\*.yml

\</\># Set to true to enable config reloading  
reload.enabled: false

\</\># Period on which files under path should be checked for changes  
#reload.period: 10s

\</\>#======== Elasticsearch template setting ==========

setup.template.settings:  
index.number\_of\_shards: 1  
#index.codec: best\_compression  
#\_source.enabled: false

\</\>#============ General =============

\</\># The name of the shipcan be used to group  
\</\># all the transactions sface.  
#name:

\</\># The tags of the shipper are i own field with each  
\</\># transaction published.  
#tags: ["service-X", "web-tier"]

\</\># Optional fields that you cmation to the  
\</\># output.  
#fields:  
\</\># env: staging

\</\>#========== Dashboards =============  
\</\># Th se sample dashex. Loading  
\</\># the dashboardsng  
\</\># options here or by up` command.  
\</\># setup.dashboards.enabled: true

\</\># The URL from whey default this URL  
\</\># has a value which name and version. For released  
\</\># versions, this URL on the [artifacts.elastic.co](http://artifacts.elastic.co)  
\</\># website.  
\</\># setup.dashboards.url: [http://192.168.1.82:5601](http://192.168.1.82:5601)

\</\>#========== Kibana =============

\</\># Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.  
\</\># This requires a Kibana endpoint configuration.  
setup.kibana:

\</\># Kibana Host  
\</\># Scheme and portset to the default (http and 5601)  
\</\># In case you specie scheme is required: [http://localhost:5601/path](http://localhost:5601/path)  
\</\># IPv6 addresses s::1]:5601  
host: "192.168.1.82:5601"

\</\># Kibana Space ID  
\</\># ID of theaded. By default,  
\</\># the Default Space will be used.  
#space.id:

\</\>#=========== Elastic Cloud ============

\</\># These settings simplify using Filebeat with the Elastic Cloud ([https://cloud.elastic.co/](https://cloud.elastic.co/)).

\</\># The cloud.id setting overwrites the `output.elasticsearch.hosts` and  
\</\># `setup.kibana.host` options.  
\</\># You can find the `cloud.id` in the Elastic Cloud web UI.  
#cloud.id:

\</\># The cloud.auth settioutput.elasticsearch.username`and </>#`output.elasticsearche format is `<user>:<pass>`.  
#cloud.auth:

\</\>#============ Outputs =============

\</\># Configure what outected by the beat.

#-------------------------- Elasticsearch output ------------------------------  
output.elasticsearch:  
\</\># Array of hosts to connect to.  
hosts: ["192.168.1.82:9200"]

\</\># Optional protocol and basic auth credentials.  
#protocol: "https"  
#username: "elastic"  
#password: "changeme"

#----------------------------- Logstash output --------------------------------  
#output.logstash:  
\</\># The Logstash hosts  
#hosts: ["localhost:5044"]

\</\># Optional SSL. By default is off.  
\</\># List of root certificates for HTTPS server verifications  
#ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"]

\</\># Certificate for SSL client authentication  
#ssl.certificate: "/etc/pki/client/cert.pem"

\</\># Client Certificate Key  
#ssl.key: "/etc/pki/client/cert.key"

\</\>#============ Processors =============

\</\># Configure processors to enhance or manipulate events generated by the beat.

processors:

- add\_host\_metadata: ~
- add\_cloud\_metadata: ~

\</\>#============ Logging =============

\</\># Sets log level. The default log level is info.  
\</\># Available log levels are: error, warning, info, debug  
#logging.level: debug

\</\># At debug level, you cnly for some components.  
\</\># To enable all selectors use ["_"]. Examples of other selectors are "beat",  
\</\># "publish", "service".  
 #logging.selectors: ["_"]

\</\>#========== X-Pack Monitoring ===========  
\</\># filebeentral Elasticsearch monitoring  
\</\># clusteElasticsearch. The  
\</\># reporting is disabled by default.

\</\># Set to true to enable the monitoring reporter.  
#monitoring.enabled: false

\</\># Sets the UUID ofitoring data for this  
\</\># Filebeat instanceasticsearch  
\</\># is enabled, the UUID is derput.elasticsearch.  
#monitoring.cluster\_uuid:

\</\># Uncommench. Most settings from the  
\</\># Elasticsearced here as well.  
\</\># Note that ta\* cluster.  
\</\># Any settinglm the Elasticsearch  
\</\># output conlt configured such  
\</\># that it is pog cluster, you can simply  
\</\># uncomment the following line.  
#monitoring.elasticsearch:

\</\>#=========== Migration ============

\</\># This allows to enable 6.7 migration aliases  
#migration.6\_to\_7.enabled: true

\</\>#=========== Added from Reference by Herman =========

\</\># If enabled,s that have changed  
\</\># in the last m the value at  
\</\># the beginntotal values for  
\</\># all non-zerdown. The default is true.  
logging.metrics.enabled: true

\</\># The period after which to log the internal metrics. The default is 30s.  
logging.metrics.period: 300s

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [October 17, 2019, 8:56pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699/8 "2019-10-17T20:56:41Z")

</div>

BTW to format your text all you need to do it

Paste it in  
Highlight it  
Press the \</\> button on on the menu bar

 ![57%20PM](https://us1.discourse-cdn.com/elastic/original/3X/c/0/c045a931cf04578fbea9dc7b54367f9961e4c23b.png)

---

<div class="post-metadata">

### Author: ![hermlam](https://avatars.discourse-cdn.com/v4/letter/h/8797f3/32.png) [@hermlam](https://discuss.elastic.co/u/hermlam)
#### Post date: [October 21, 2019, 9:44am UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699/9 "2019-10-21T09:44:48Z")

</div>

Hi Stephen,  
Ok I will remember the format tip.

But did you find any issues in my .yml?

Thanks,  
Herman

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [October 21, 2019, 2:50pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699/10 "2019-10-21T14:50:04Z")

</div>

> [@hermlam](#):
>
> 2019-10-15T19:32:07.462+0200 INFO kibana/client.go:117 Kibana url: [http://localhost:5601](http://localhost:5601)

It is still hard to read so I can not tell if there are other errors.

But nothing obvious but it is still hard to read, that error says that filebeat is is still trying to connect to kibana on localhost. the line

> [@hermlam](#):
>
> ```
> # IPv6 addresses s::1]:5601
> host: "192.168.1.82:5601"
> 
> ```

Seems to be the correct, how are you starting filebeat?

---

<div class="post-metadata">

### Author: ![hermlam](https://avatars.discourse-cdn.com/v4/letter/h/8797f3/32.png) [@hermlam](https://discuss.elastic.co/u/hermlam)
#### Post date: [October 23, 2019, 8:14am UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699/11 "2019-10-23T08:14:58Z")

</div>

Hi,  
I am starting Filebeat as: sudo service filebeat start.

I have been searching through filebeat.yml, elasticsearch.yml and kibana.yml and no 'localhost' found. Very strange.

---

<div class="post-metadata">

### Author: ![hermlam](https://avatars.discourse-cdn.com/v4/letter/h/8797f3/32.png) [@hermlam](https://discuss.elastic.co/u/hermlam)
#### Post date: [November 4, 2019, 7:19am UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699/12 "2019-11-04T07:19:40Z")

</div>

Hi Good morning,

I am still having problems with the Filebeat dashboard create.  
On one of my Windows machine I installed Winlogbeat, with a similar yml and changed the IP's of Elastic and Kibana, the same as in the filebeat.yml. And the dashboards of Winlogbeat were created without issues.  
So I don't understand the filebeat issue

Herman

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 2, 2019, 7:20am UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699/13 "2019-12-02T07:20:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.