I have an ELK stack install on a RockNSM 2.5 machine with Elastic version 7.6
I have the server running and I want to install beats on other hosts in my network. I'm running into issues running the beats setup as it keeps rejecting the connection.
My elastic server is 192.168.1.27
I have the following in my auditbeat.yml file on my host computer (Ubuntu server)
output.elasticsearch: hosts: ["192.168.1.27:9200"] setup.kibana: host: "192.168.1.27:5601"
To allow connection other than the default localhost, I changed my
network.hosts in /etc/elasticsearch/elasticsearch.yml to
Additionally, I had to add the following lines:
discovery.seed_hosts: ["host1"] cluster.initial_master_nodes: ["node-1"]
note: “host1” = node.name (same as node.name in the yml file)
and comment out the following:
That worked. I tested it with netcat and succeeded.
I ran into another problem with Kibana when I ran the
sudo auditbeat setup
I get: "connection refused"
Overwriting ILM policy is disabled. Set `setup.ilm.overwrite:true` for enabling. Index setup finished. Loading dashboards (Kibana must be running and reachable) Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to http://192.168.1.27:5601/api/status fails: fail to execute the HTTP GET request: Get http://192.168.1.27:5601/api/status: dial tcp 192.168.1.27:5601: connect: connection refused. Response: .
I looked around online and found that I have to define
server.host in /etc/kibana/kibana.yml to the Kibana’s IP address otherwise its default is localhost.
I edited the kibana.yml and added
server.host: 192.168.1.27 to look like below:
server.port: 5601 server.name: "RockNSM" server.host: 192.168.1.27 server.defaultRoute: "/app/kibana#/dashboard/6151e9d0-bf83-11e9-85bb-3b744f61312d" elasticsearch.hosts: "http://127.0.0.1:9200"
sudo auditbeat setup on the host machine and voila! it worked!
Overwriting ILM policy is disabled. Set `setup.ilm.overwrite:true` for enabling. Index setup finished. Loading dashboards (Kibana must be running and reachable) Loaded dashboards
or at least it told me it worked… HOWEVER…
Now I can’t connect to Kibana. Kibana is running, even when i restart it, everything is running. I go to the <Kibana's IP>/app/kibana#/ and I get a 503 error .
I do a
netstat -ano and I get a TIME_WAIT on the state of my connection
I went back to the kibana.yml file and tried to change this
and that didn’t work…
In the end, I changed the kibana.yml file back to normal and commented out the
server.port: 5601 server.name: "RockNSM" #server.host: 192.168.1.27 server.defaultRoute: "/app/kibana#/dashboard/6151e9d0-bf83-11e9-85bb-3b744f61312d" elasticsearch.hosts: "http://127.0.0.1:9200"
I got my Kibana dashboard back but the my auditbeat host is gone. back to square 1!
I’m once again out of things to try. looking for guidance. Just trying to deploy beats to hosts. I run into similar problems with other beats deployment. Thanks!