# Having trouble connecting to Kibana. New user **URL:** \ **Category:** Kibana\ **Created:** [January 21, 2025, 8:20pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476 "2025-01-21T20:20:26Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 21, 2025, 8:20pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/1 "2025-01-21T20:20:27Z")
Can't get the server to listen on port 5601. ![Screenshot 2025-01-21 at 3.14.05 PM](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bc947fbc2cbdf41f197484ad54b961852c081452.png) netstat -ant shows nothing on port 5601. Getting connection refused on port 5601 with Curl. telemetry.enabled: false telemetry.optIn: false newsfeed.enabled: false server.host: '0.0.0.0' server.port: 5601 server.maxPayload: 8388608 server.publicBaseUrl: server.ssl.enabled: true server.ssl.certificateAuthorities: /etc/kibana/certs/ca/ca.crt server.ssl.key: /etc/kibana/certs/myhost/myhost.key server.ssl.certificate: /etc/kibana/certs/myhost/myhost.crt elasticsearch.hosts: elasticsearch.username: 'kibana\_system' elasticsearch.password: 'PASSWORD' elasticsearch.ssl.certificateAuthorities: /etc/kibana/certs/ca/ca.crt elasticsearch.ssl.key: /etc/kibana/certs/myhost/myhost.key elasticsearch.ssl.certificate: /etc/kibana/certs/myhost/myhost.crt elasticsearch.ssl.verificationMode: 'certificate' elasticsearch.requestTimeout: 132000 elasticsearch.shardTimeout: 120000 kibana.autocompleteTimeout: 2000 kibana.autocompleteTerminateAfter: 500000 monitoring.enabled: true monitoring.kibana.collection.enabled: true monitoring.kibana.collection.interval: 30000 monitoring.ui.enabled: true monitoring.ui.min\_interval\_seconds: 20 xpack.maps.showMapVisualizationTypes: true xpack.security.enabled: true xpack.security.audit.enabled: false I updated the PASSWORD to my own password. ---
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 21, 2025, 8:24pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/2 "2025-01-21T20:24:10Z")
UFW disabled, not a VM in the cloud, it's local. Why can't i even see a kibana.log? tail -f /var/log/kibana/kibana.log ---
**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\ **Post date:** [January 21, 2025, 8:36pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/3 "2025-01-21T20:36:14Z")
try sudo lsof -p PID-of-kibana and look for any network ports. But it won't start listening on port 5601 until a fair way into its startup process. In my case, I see: ```auto sudo lsof -Pn -p 15950 | fgrep IPv node 15950 vf 19u IPv4 0xd5bd95614eeaec8d 0t0 TCP 192.168.2.163:5601 (LISTEN) node 15950 vf 22u IPv4 0xe30558dfc17688dc 0t0 TCP 127.0.0.1:54778->127.0.0.1:9200 (ESTABLISHED) node 15950 vf 23u IPv4 0x338ee9785da10153 0t0 TCP 127.0.0.1:54802->127.0.0.1:9200 (ESTABLISHED) node 15950 vf 25u IPv4 0x1e4360ba51ae7f7 0t0 TCP 192.168.2.163:5601->192.168.2.163:54805 (ESTABLISHED) node 15950 vf 26u IPv4 0x1dbbeecd36bcc3ff 0t0 TCP 127.0.0.1:54806->127.0.0.1:9200 (ESTABLISHED) node 15950 vf 108u IPv4 0x6e8949ed5fa45cbe 0t0 TCP 127.0.0.1:52866->127.0.0.1:9200 (ESTABLISHED) ``` btw, posting images full of text is considered a bit impolite, just cut and paste the text and quote it accordingly. ---
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 21, 2025, 9:37pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/4 "2025-01-21T21:37:45Z")
> [@RainTown](#): > > sudo lsof -p PID-of-kibana Alright, didn't realize that. ps -aux | grep kibana kibana 1951468 127 1.0 11842804 279928 ? Rsl 21:35 0:14 /usr/share/kibana/bin/../node/glibc-217/bin/node /usr/share/kibana/bin/../src/cli/dist root 1951805 0.0 0.0 6432 656 pts/1 S+ 21:36 0:00 grep --color=auto kibana I don't get anything for lsof -P 1951468. The PID keeps changing for kibana ---
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 22, 2025, 3:33am UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/5 "2025-01-22T03:33:34Z")
Did I do something wrong with that reply? Lsof didn't give me any output. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [January 22, 2025, 5:52am UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/6 "2025-01-22T05:52:41Z")
You can use netstat to get ports: ```auto netstat -tlpn | grep LISTEN netstat -tlpn | grep ":5601" netstat -tlpn | grep "kibana" ``` However, check kibana.log again, you have "Kibana is starting" which doesn't mean it's up and running. I you don't have records in kibana.log, add in kibana.yml: ```auto logging.root.level: info logging.appenders.default: type: file fileName: /path/kibana.log layout: type: pattern ``` ---
**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\ **Post date:** [January 22, 2025, 10:13am UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/7 "2025-01-22T10:13:01Z")
Well, the key line was: > The PID keeps changing for kibana So likely kibana is starting, failing, and looping around that circle. > elasticsearch.hosts: > elasticsearch.username: 'kibana\_system' > elasticsearch.password: 'PASSWORD' The elasticsearch.hosts value is really blank? Is elasticsearch already running on this same system? You can connect to it with curl or other tools on port 9200 ? I'd be explicit and set it: elasticsearch.hosts: ["[http://localhost:9200](http://localhost:9200)"] in kibana.yml, or comment it out as I believe that specific setting is its default value. Anyways, please check output from command below, as root, and share here if not clear on what its telling you. ```auto journalctl -b -u kibana --output=short-full ``` This is something like what you should see from lsof when its all OK: ```auto kevin@u2024:~$ sudo systemctl start elasticsearch kevin@u2024:~$ sudo lsof -i :9200 kevin@u2024:~$ sudo lsof -i :9200 kevin@u2024:~$ sudo lsof -i :9200 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME java 10351 elasticsearch 557u IPv6 73748 0t0 TCP *:9200 (LISTEN) kevin@u2024:~$ sudo systemctl start kibana kevin@u2024:~$ sudo lsof -i :5601 kevin@u2024:~$ sudo lsof -i :5601 kevin@u2024:~$ sudo lsof -i :5601 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME node 10496 kibana 94u IPv4 75856 0t0 TCP u2024.fritz.box:5601 (LISTEN) ``` Note there's a few seconds before Kibana is listening on port 5601 or elasticsearch is listing on port 9200 ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [January 22, 2025, 1:40pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/8 "2025-01-22T13:40:53Z")
Set to https: `elasticsearch.hosts: ["https://localhost:9200"]` ---
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 22, 2025, 7:36pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/10 "2025-01-22T19:36:02Z")
Yeah, the site doesn't let me post these https:// URLs. Omitted them so that it could let me post. Yes, already using https for the elasticsearch.hosts: line. ![Screenshot 2025-01-22 at 2.33.50 PM](https://us1.discourse-cdn.com/elastic/original/3X/f/d/fd4ecf8ca997959890c649d0e2f63185ac795b68.png) ---
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 22, 2025, 7:37pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/11 "2025-01-22T19:37:50Z")
The part that I don't get is why it says that kibana is running. ![Screenshot 2025-01-22 at 2.37.18 PM](https://us1.discourse-cdn.com/elastic/original/3X/2/b/2bd2416e7b0a8d232c536581131b650a9b0850c9.png) ---
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 22, 2025, 7:39pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/12 "2025-01-22T19:39:49Z")
> [@RainTown](#): > > `journalctl -b -u kibana --output=short-full` Do I need to increase the logging level? ![Screenshot 2025-01-22 at 2.39.04 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/8/88771ae4d777ab6c4f243146475491cb20f35ec5.png) ---
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 22, 2025, 7:43pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/13 "2025-01-22T19:43:08Z")
> [@RainTown](#): > > journalctl -b -u kibana --output=short-full is the issue? Xpack settings? ![Screenshot 2025-01-22 at 2.42.24 PM](https://us1.discourse-cdn.com/elastic/original/3X/c/6/c6524e0e386468bd687c5547bb4bd28c499f6063.png) ---
**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\ **Post date:** [January 22, 2025, 8:37pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/14 "2025-01-22T20:37:26Z")
> [@RainTown](#): > > btw, posting images full of text is considered a bit impolite, just cut and paste the text and quote it accordingly. Please, run the command I asked, post the _ **entire text** _ of the output. I'm not squinting at that tiny text. btw, where did you get the above kibana.yml from? It's not the OOTB config. What release are you using? ---
**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\ **Post date:** [January 22, 2025, 8:51pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/15 "2025-01-22T20:51:21Z")
> [@CarlosDanger142](#): > > the site doesn't let me post these https:// URLs Yeah, its really annoying the site does not allow ```auto elasticsearch.hosts: ["https://localhost:9200"] ``` 😉 ---
**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\ **Post date:** [January 22, 2025, 8:56pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/16 "2025-01-22T20:56:23Z")
> The part that I don't get is why it says that kibana is running. systemctl started it, and it started. So it is running at the time you ran the status command. The "0s ago" means it just started, it likely crashed soon afterwards. ---
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 22, 2025, 10:01pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/17 "2025-01-22T22:01:39Z")
I was also getting all sorts of restrictions when I tried to add more than one image. I thought it was related to the fact I was a new user. ---
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 22, 2025, 10:05pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/18 "2025-01-22T22:05:37Z")
Looks like it's related to myhost.key 2025-01-22 20:06:57 UTC ubuntu-20 systemd[1]: kibana.service: Main process exited, code=exited, status=1/FAILURE Wed 2025-01-22 20:06:57 UTC ubuntu-20 systemd[1]: kibana.service: Failed with result 'exit-code'. Wed 2025-01-22 20:07:00 UTC ubuntu-20 systemd[1]: kibana.service: Scheduled restart job, restart counter is at 3. Wed 2025-01-22 20:07:00 UTC ubuntu-20 systemd[1]: Stopped Kibana. Wed 2025-01-22 20:07:00 UTC ubuntu-20 systemd[1]: Started Kibana. Wed 2025-01-22 20:07:00 UTC ubuntu-20 kibana[5775]: Kibana is currently running with legacy OpenSSL providers enabled! For details and instructions on how to disable see https://\> Wed 2025-01-22 20:07:02 UTC ubuntu-20 kibana[5775]: {"log.level":"info","@timestamp":"2025-01-22T20:07:02.003Z","log.logger":"elastic-apm-node","ecs.version":"8.10.0","agentVersi\> Wed 2025-01-22 20:07:02 UTC ubuntu-20 kibana[5775]: Native global console methods have been overridden in production environment. Wed 2025-01-22 20:07:17 UTC ubuntu-20 kibana[5775]: FATAL Error: ENOENT: no such file or directory, open '/etc/kibana/certs/myhost/myhost.key' Wed 2025-01-22 20:07:17 UTC ubuntu-20 systemd[1]: kibana.service: Main process exited, code=exited, status=1/FAILURE ---
**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\ **Post date:** [January 22, 2025, 10:24pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/19 "2025-01-22T22:24:45Z")
Yes, when you have these settings (from where you didn't explain) ```auto elasticsearch.ssl.certificateAuthorities: /etc/kibana/certs/ca/ca.crt elasticsearch.ssl.key: /etc/kibana/certs/myhost/myhost.key elasticsearch.ssl.certificate: /etc/kibana/certs/myhost/myhost.crt ``` but didn't check those files actually exist? ```auto Wed 2025-01-22 20:07:00 UTC ubuntu-20 systemd[1]: Started Kibana. ... Wed 2025-01-22 20:07:17 UTC ubuntu-20 systemd[1]: kibana.service: Main process exited, code=exited, status=1/FAILURE ``` 15 second between start and exit. And it's quite annoying that you want help but cant follow very clear and simple requests or questions, and drip feed information. Good luck to you and your users. ---
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 22, 2025, 10:58pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/20 "2025-01-22T22:58:45Z")
> [@CarlosDanger142](#): > > FATAL Error: ENOENT: no such file or directory, open '/etc/kibana/certs/myhost/myhost.key' OK, Thanks for trying. ---
**Author:** ![CarlosDanger142](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosdanger142/32/140829_2.png) [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Post date:** [January 22, 2025, 10:59pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476/21 "2025-01-22T22:59:44Z")
I don't have any users. Brand new to this. Just experimenting. Perhaps you could be a little more understanding?