Hey I have a problem that has been bothering me for sometime now and I would really use some help here.
I am running elk stack using docker on an amazon ec2 instance (ubuntu 22.04) as a siem, the problem is when I try to use the integrations or add them I navigate to the integrations page but they never load, instead it just gets stuck loading(figure down below).
Hi @slapjackuser Welcome to the community
Perhaps take a look at
hello @slapjackuser
I have faced the same problem before and i think i can help you
Please let me know you are still facing the same issue
2 Likes
Hi Mahmoud,
Thank you for the reply. And yes, unfortunately I am still facing the same issue. I had it running on a gcp server without any issues, but when I tried it on an instance in openstack private cloud and aws I face that issue for some reason, even though it was an ubuntu 22.04 and using docker in all of them. I would really appreciate your help here. Thank you in advance !
I had the same issue recently. For me, it was being behind a proxy. Once a proxy rule was in place and proxy settings applied on both the VM and Kibana, I had no issue. I think the site was epr.elastic.co, but I could be wrong. Is it reachable from your openstack or AWS instance?
If it is a proxy issue, there's a specific setting for EPR in kibana.yml:
# Proxy settings for EPR (Elastic Package Registry)
xpack.fleet.registryProxyUrl: "yourProxyAddressAndPortHere"
(In addition to any OS-specific proxy settings).
Hi Andrew,
thank you for the fast response, I will try it and let you know about the results.
Hi @slapjackuser,
can you please run the below commands
curl https://artifacts.elastic.co/downloads/ -v
curl -v https://epr.elastic.co
and share the result
Hi Mahmoud thank you for the reply,
I just tried the curls from both the host machine and inside the kibana docker container.
When running it on the host I think everything is fine I get the following output :
* Trying 34.120.127.130:443...
* Connected to [artifacts.elastic.co](http://artifacts.elastic.co/) (34.120.127.130) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=[elastic.co](http://elastic.co/)
* start date: Sep 24 22:54:41 2024 GMT
* expire date: Dec 23 22:54:40 2024 GMT
* subjectAltName: host "[artifacts.elastic.co](http://artifacts.elastic.co/)" matched cert's "[artifacts.elastic.co](http://artifacts.elastic.co/)"
* issuer: C=US; O=Let's Encrypt; CN=R11
* SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* Using Stream ID: 1 (easy handle 0x5c12b67e3eb0)
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET /downloads/ HTTP/2
> Host: [artifacts.elastic.co](http://artifacts.elastic.co/)
> user-agent: curl/7.81.0
> accept: */*
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
< HTTP/2 404
< date: Tue, 19 Nov 2024 10:48:50 GMT
< content-length: 0
< strict-transport-security: max-age=31536000; includeSubDomains
< via: 1.1 google
< alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
<
* Connection #0 to host [artifacts.elastic.co](http://artifacts.elastic.co/) left intact
But when I try it from inside the kibana container I get the following output:
* Trying 34.120.127.130:443...
* TCP_NODELAY set
* Connected to [artifacts.elastic.co](http://artifacts.elastic.co/) (34.120.127.130) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: Connection reset by peer in connection to [artifacts.elastic.co:443](http://artifacts.elastic.co:443/)
* Closing connection 0
curl: (35) OpenSSL SSL_connect: Connection reset by peer in connection to [artifacts.elastic.co:443](http://artifacts.elastic.co:443/)