413 Request Entity Too Large

# Filebeat not able to connect to kibana hosted in another server **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 12, 2024, 12:03pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-connect-to-kibana-hosted-in-another-server/370391 "2024-11-12T12:03:37Z")\ **Posts on this page:** 9\ **Page:** 1

**Author:** ![Nanditha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nanditha/32/137350_2.png) [@Nanditha](https://discuss.elastic.co/u/Nanditha)\ **Post date:** [November 12, 2024, 12:03pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-connect-to-kibana-hosted-in-another-server/370391/1 "2024-11-12T12:03:37Z")

Hi, I have hosted elasticsearch and kibana in one server and filebeat and my application in another server. I want to send my application logs to elasticsearch via filebeat. I have configured my filebeat.yml to IP of elasticsearch and kibana. When i do curl GET on elasticsearch, im getting proper response, but to kibana i'm getting error as `"curl: (35) error:0A00010B:SSL routines::wrong version number"` Also when i do `"./filebeat setup -e"` i'm getting below error. ```auto "message":"Exiting: error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory /elk_stack/filebeat-8.14.3-linux-x86_64/kibana: failed to import Kibana index pattern: 1 error: error loading index pattern: returned 413 to import file: error extracting JSON for error response: invalid character '<' looking for beginning of value. Response: \r\n413 Request Entity Too Large\r\n\r\n413 Request Entity Too Large\r\n

nginx/1.24.0 (Ubuntu)\r\n\r\n\r\n","service.name":"filebeat","ecs.version":"1.6.0"} Exiting: error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory /elk_stack/filebeat-8.14.3-linux-x86_64/kibana: failed to import Kibana index pattern: 1 error: error loading index pattern: returned 413 to import file: error extracting JSON for error response: invalid character '<' looking for beginning of value. Response: 413 Request Entity Too Large 413 Request Entity Too Large

nginx/1.24.0 (Ubuntu) ``` ```auto Versions : Elasticsearch : 8.14.3 Kibana : 8.14.3 Filebeat : 8.14.3 ``` Can anyone please help on this issue ? Thanks, Nanditha ---

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 12, 2024, 2:35pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-connect-to-kibana-hosted-in-another-server/370391/2 "2024-11-12T14:35:25Z")

Hi @Nanditha Share your filebeat.yml please. How did you install elasticsearch and Kibana ---

**Author:** ![Nanditha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nanditha/32/137350_2.png) [@Nanditha](https://discuss.elastic.co/u/Nanditha)\ **Post date:** [November 13, 2024, 5:23am UTC](https://discuss.elastic.co/t/filebeat-not-able-to-connect-to-kibana-hosted-in-another-server/370391/3 "2024-11-13T05:23:04Z")

Hi @stephenb, thank you for your replay. I have installed elasticsearch and kibana via debian package, referring to below official elasticsearch links. > **[Install Elasticsearch with Debian Package | Elasticsearch Guide \[8.16\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html)** > **[Install Kibana with Debian package | Kibana Guide \[8.16\] | Elastic](https://www.elastic.co/guide/en/kibana/current/deb.html)** one more thing I missed mentioning in my previous post, my elastic and kibana is in AWS EC2 instance and my filebeat is inside a docker container. I have allowed all/any connection to my container using this command, `docker run -it --net=host imageid bash` Here is my filebeat.yml : ```auto # ============================== Filebeat inputs =============================== filebeat.inputs: - type: log id: my-filestream-id enabled: true paths: - /nanditha/evaluation/logs/* - /isa/evaluation/logs/exec_time.log multiline.pattern: '^\[\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d+\] \[INFO\] \[Logged into as user\]' multiline.negate: true multiline.match: after multiline.timeout: 30s multiline.flush_pattern: '\[process shutting down\]' # ============================== Filebeat modules ============================== filebeat.config.modules: path: ${path.config}/modules.d/*.yml reload.enabled: false # ======================= Elasticsearch template setting ======================= setup.template.settings: index.number_of_shards: 1 # =================================== Kibana =================================== setup.kibana: host: "x.x.x.x:80" username: "x" password: "x" # ---------------------------- Elasticsearch Output ---------------------------- output.elasticsearch: hosts: ["x.x.x.x:9200"] protocol: "https" username: "x" password: "x" ssl.verification_mode: none # ================================= Processors ================================= processors: - add_host_metadata: when.not.contains.tags: forwarded - add_cloud_metadata: ~ - add_docker_metadata: ~ - add_kubernetes_metadata: ~ # ================================== Logging =================================== logging.level: info logging.to_files: true logging.files: path: /isa/containers/eval_pipeline_mlflow/elk_stack/filebeat-8.14.3-linux-x86_64/logs name: filebeat keepfiles: 7 permissions: 0640 ``` ---

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 13, 2024, 6:36am UTC](https://discuss.elastic.co/t/filebeat-not-able-to-connect-to-kibana-hosted-in-another-server/370391/4 "2024-11-13T06:36:46Z")

> [@Nanditha](#): > > `

nginx/1.24.0` > [@Nanditha](#): > > ` host: "x.x.x.x:80"` Looks like you're running an nginx proxy in front of kibana. I suspect that may be your issue here. You'll want that setup to go directly to Kibana. ---

**Author:** ![Nanditha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nanditha/32/137350_2.png) [@Nanditha](https://discuss.elastic.co/u/Nanditha)\ **Post date:** [November 13, 2024, 9:09am UTC](https://discuss.elastic.co/t/filebeat-not-able-to-connect-to-kibana-hosted-in-another-server/370391/5 "2024-11-13T09:09:16Z")

Hi @stephenb, Can you please help me with the steps/any website i can refer to, if you know. ---

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 13, 2024, 2:26pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-connect-to-kibana-hosted-in-another-server/370391/6 "2024-11-13T14:26:18Z")

Steps for what? In filebeat.yml you need to set > [@Nanditha](#): > > ```auto > setup.kibana: > host: "x.x.x.x:80" > username: "x" > password: "x" > > ``` Directly to the Kibana host port.... > **[Configure the Kibana endpoint | Filebeat Reference \[8.16\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/setup-kibana-endpoint.html)** ---

**Author:** ![Nanditha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nanditha/32/137350_2.png) [@Nanditha](https://discuss.elastic.co/u/Nanditha)\ **Post date:** [November 15, 2024, 4:08am UTC](https://discuss.elastic.co/t/filebeat-not-able-to-connect-to-kibana-hosted-in-another-server/370391/7 "2024-11-15T04:08:38Z")

Thank you. The issue is resolved. I disabled nginx and set my kibana port to default(5601) and updated same in my filebeat.yml. Everything works now. ---

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [November 22, 2024, 12:05am UTC](https://discuss.elastic.co/t/filebeat-not-able-to-connect-to-kibana-hosted-in-another-server/370391/8 "2024-11-22T00:05:35Z")

If you would like to keep using nginx you just need to identify what path you've put the kibana api behind, like `http://nginx:80/kibanaapi` and then set `setup.kibana.path` to that path for example: `setup.kibana.path: kibanaapi` ---

**Author:** ![Nanditha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nanditha/32/137350_2.png) [@Nanditha](https://discuss.elastic.co/u/Nanditha)\ **Post date:** [December 3, 2024, 9:19am UTC](https://discuss.elastic.co/t/filebeat-not-able-to-connect-to-kibana-hosted-in-another-server/370391/9 "2024-12-03T09:19:58Z")

Sure, Thank you.