My kibana.service failed after i made a change in kibana.yml

i installed kibana by rpm, it was running til i made some change to kibana.yml, after that it failed immediately. This is what i changed:

server.port: 5601

server.host:"10.6.145.226"

elasticsearch.hosts: ["https:/_/10.6.145.226:9200"]

This is my Kibana.yml file

For more configuration options see the configuration guide for Kibana in

Documentation

=================== System: Kibana Server ===================

Kibana is served by a back end server. This setting specifies the port to use.

server.port: 5601

Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.

The default is 'localhost', which usually means remote machines will not be able to connect.

To allow connections from remote users, set this parameter to a non-loopback address.

server.host:"10.6.145.226"

Enables you to specify a path to mount Kibana at if you are running behind a proxy.

Use the server.rewriteBasePath setting to tell Kibana if it should remove the basePath

from requests it receives, and to prevent a deprecation warning at startup.

This setting cannot end in a slash.

server.basePath: ""

Specifies whether Kibana should rewrite requests that are prefixed with

server.basePath or require that they are rewritten by your reverse proxy.

Defaults to false.

server.rewriteBasePath: false

Specifies the public URL at which Kibana is available for end users. If

server.basePath is configured this URL should end with the same basePath.

server.publicBaseUrl: ""

The maximum payload size in bytes for incoming server requests.

server.maxPayload: 1048576

The Kibana server's name. This is used for display purposes.

server.name: "your-hostname"

=================== System: Kibana Server (Optional) ===================

Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.

These settings enable SSL for outgoing requests from the Kibana server to the browser.

server.ssl.enabled: false
server.ssl.certificate: /path/to/your/server.crt
server.ssl.key: /path/to/your/server.key

=================== System: Elasticsearch ===================

The URLs of the Elasticsearch instances to use for all your queries.

elasticsearch.hosts: ["https:/_/10.6.145.226:9200"]

If your Elasticsearch is protected with basic authentication, these settings provide

the username and password that the Kibana server uses to perform maintenance on the Kibana

index at startup. Your Kibana users still need to authenticate with Elasticsearch, which

is proxied through the Kibana server.

elasticsearch.username: "kibana_system"
elasticsearch.password: "pass"

Kibana can also authenticate to Elasticsearch via "service account tokens".

Service account tokens are Bearer style tokens that replace the traditional username/password based configuration.

fix the typo

You dont need/want the "_"

elasticsearch.hosts: ["https://10.6.145.226:9200"]

Hi Kevin, its the "" i put it in following the policy of website, in my yml file in the system it doesnt have ""

If its your company policy?

Change it back?

sorry for that, i didnt explain it clearly. Its the policies of this discuss web that we are communicating doesnt allow me to post a complete link so i have to put - in to the middle //

This is where we are:

You posted

I changed some configs and now stuff doesn't work. (providing nothing else, no log of any error, just 3 lines of configuration).

I noted that some configs is broken, suggested you fix it. The 3 lines of information you supplied had a clear and obvious error.

You said I really didn't change it to some configs due to some obscure policy.

OK, then I suggested change some configs back to whatever it was before, when it was working. Did you try that?

For now, it is impossible to diagnose your problem using the information so far shared. Error messages, some context, kibana logs, ... might help.

This is what i got when i run journalctl -eu kibana

Kibana is currently running with legacy OpenSSL providers enabled! For details and instructions on how to disable see Use Kibana in a production environment | Kibana Guide [8.14] | Elastic
{"log.level":"info","@timestamp":"2025-03-06T09:10:30.755Z","log.logger":"elastic-apm-node","ecs.version":"8.10.0","agentVersion":"4.5.0","env":{"pid":127077,"proctitle":"/usr/share/kibana/bin/../node/bin/node","os":"linux
FATAL CLI ERROR YAMLException: can not read a block mapping entry; a multiline key may not be an implicit key at line 13, column 1:

i also check in the YML file and when i undo the config, kibana activated

that reads like you are just messing up when editing the file, adding (maybe invisible) characters

After editing, check and validate the kibana.yml with a tool, e.g.

or via command line with (eg) yamllint

This works for me:

# cat $HOME/.yamllint
extends: default

rules:
# don't fail if a line is long
 line-length: disable
 document-start: disable
 comments: disable
# yamllint /etc/elasticsearch/elasticsearch.yml
# yamllint /etc/kibana/kibana.yml
#

thank you so much, finally its run @@

after i delete the space in yml its run completely and i want to try your cmd line but i dont know where to put it. Sr im kinda new with Linux and stuff

dont worry about it, main thing is it now works.

Good luck with your project.

u help me a lot, thank you man

1 Like