# Installing Beats (Filebeat, Auditbeat, etc) on remote host

**URL:** <https://discuss.elastic.co/t/installing-beats-filebeat-auditbeat-etc-on-remote-host/228590>\
**Category:** Beats\
**Created:** [April 17, 2020, 9:54pm UTC](https://discuss.elastic.co/t/installing-beats-filebeat-auditbeat-etc-on-remote-host/228590 "2020-04-17T21:54:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mokotoy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mokotoy/32/66562_2.png) [@mokotoy](https://discuss.elastic.co/u/mokotoy)\
**Post date:** [April 17, 2020, 9:54pm UTC](https://discuss.elastic.co/t/installing-beats-filebeat-auditbeat-etc-on-remote-host/228590/1 "2020-04-17T21:54:32Z")

</div>

I have an ELK stack install on a RockNSM 2.5 machine with Elastic version 7.6

I have the server running and I want to install beats on other hosts in my network. I'm running into issues running the beats setup as it keeps rejecting the connection.

My elastic server is **192.168.1.27**

I have the following in my _auditbeat.yml_ file on my host computer (Ubuntu server)

```
output.elasticsearch:
 hosts: ["192.168.1.27:9200"]

setup.kibana:
  host: "192.168.1.27:5601"

```

To allow connection other than the default localhost, I changed my `network.hosts` in _/etc/elasticsearch/elasticsearch.yml_ to

```auto
 network.host: 0.0.0.0

```

Additionally, I had to add the following lines:

```auto
  discovery.seed_hosts: ["host1"]
  cluster.initial_master_nodes: ["node-1"]

```

> note: “host1” = node.name (same as node.name in the yml file)

and comment out the following:

```auto
#discovery.type: single-node

```

That worked. I tested it with netcat and succeeded.

I ran into another problem with Kibana when I ran the `sudo auditbeat setup`

I get: "connection refused"

```auto
    Overwriting ILM policy is disabled. Set `setup.ilm.overwrite:true` for enabling.

    Index setup finished.
    Loading dashboards (Kibana must be running and reachable)
    Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to 
    http://192.168.1.27:5601/api/status fails: fail to execute the HTTP GET request: Get 
    http://192.168.1.27:5601/api/status: dial tcp 192.168.1.27:5601: connect: connection refused. 
    Response: .

```

I looked around online and found that I have to define `server.host` in /etc/kibana/kibana.yml to the Kibana’s IP address otherwise its default is localhost.

I edited the kibana.yml and added `server.host: 192.168.1.27` to look like below:

```auto
server.port: 5601
server.name: "RockNSM"
server.host: 192.168.1.27
server.defaultRoute: "/app/kibana#/dashboard/6151e9d0-bf83-11e9-85bb-3b744f61312d"
elasticsearch.hosts: "http://127.0.0.1:9200"

```

I ran `sudo auditbeat setup` on the host machine and **voila!** it worked!

```auto
Overwriting ILM policy is disabled. Set `setup.ilm.overwrite:true` for enabling.
Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards

```

or at least it told me it worked… **HOWEVER…**

Now I can’t connect to Kibana. Kibana is running, even when i restart it, everything is running. I go to the _\<Kibana's IP\>/app/kibana#/_ and I get a **503 error**.

I do a `netstat -ano` and I get a TIME\_WAIT on the state of my connection

I went back to the kibana.yml file and tried to change this

`elasticsearch.hosts: "http://127.0.0.1:9200"`

to this:

`elasticsearch.hosts: "http://192.168.1.27:9200"`

and that didn’t work…

In the end, I changed the kibana.yml file back to normal and commented out the `server.host`

```auto
server.port: 5601
server.name: "RockNSM"
#server.host: 192.168.1.27
server.defaultRoute: "/app/kibana#/dashboard/6151e9d0-bf83-11e9-85bb-3b744f61312d"
elasticsearch.hosts: "http://127.0.0.1:9200"

```

I got my Kibana dashboard back but the my auditbeat host is gone. back to square 1!

I’m once again out of things to try. looking for guidance. Just trying to deploy beats to hosts. I run into similar problems with other beats deployment. Thanks!

-moki

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2020, 11:54pm UTC](https://discuss.elastic.co/t/installing-beats-filebeat-auditbeat-etc-on-remote-host/228590/2 "2020-05-15T23:54:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.