Problem with Filebeat and Kibana

Elastic Stack Beats
1

Hi,

I use Filebeat 7.4 and Kibana 7.3.2 . Filebeat receive cleanly the log. But he don't forwad to Kibana.
When I do : filebeat setup
I have this result :

Index setup finished.
 Loading dashboards (Kibana must be running and reachable)
 Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to http://172.17.2.9:5601/api/status fails: fail to execute the HTTP GET request: Get http://172.17.2.9:5601/api/status: dial tcp 172.17.2.9:5601: connect: connection refused. Response: .

Can you help me please ?
Best regards,

2

hey @Jonathan_Sieger

do you see anything in Kibana logs? can you connect to Kibana from where Beat is running? can you verify that Kibana is in fact listening on specified port on that URL?

4

As per above error it is clear that your kibana server is not reachable from that machine where you installed filebeat and trying to rin filebeat setup.

Can you please try below command on machine where you run filebeat setup:

telnet 172.17.2.9 5601

If you are not able to telnet then check your firewall rule and kibana service.

Thanks.

5

@Jonathan_Sieger,

According to this output your kibana is running on localhost. You need to run it over internal IP (private ip) then it will be reachable from beat machine. If both machine are not reachable then contact your system admin team they will help you in reach ability of both machine.

Thanks.

1 Like
7

@Jonathan_Sieger,

Run your kibana over 172.17.2.9 or change in your filebeat.yml configuration replace kibana IP 172.17.2.9 with 127.0.0.1.

Thanks.

9

@Jonathan_Sieger,

Can you please check filebeat service is running properly or not? If no can you please provide some error logs from filebeat?

Also please provide your filebeat.yml config.

Thanks.

11

@Jonathan_Sieger ,

In above part port is missing.

setup.kibana:
  host: "127.0.0.1:5601"

Thanks.

12

Nothing have changed

systemctl status filebeat.service : 
oct. 09 15:06:12 filebeat[4148]: 2019-10-09T15:06:12.055+0200        WARN        elasticsearch/client.go:535        Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbf5f...
oct. 09 15:06:18 filebeat[4148]: 2019-10-09T15:06:18.973+0200        WARN        elasticsearch/client.go:535        Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbf5f...
13

@Jonathan_Sieger, did you restart the filebeat service after making changes in filebeat.yml file?
If yes, please provide log from filebeat because service status is not enough to troubleshoot the issue log may give some lead.

Thanks.

14

Hi,

I resolve my issue, the filebeat.yml was not properly configured with my last version of elasticsearch and my app Wazuh in Kibana. Thanks you for your help.

But after the upgrade, Elasticsearch and Kibana use the CPU at 122%.. I have 8 Go RAM and 2 vCPU. I add more CPU ?

15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.