# Set up ELK stack and can only see json when I browse to it

**URL:** <https://discuss.elastic.co/t/set-up-elk-stack-and-can-only-see-json-when-i-browse-to-it/355658>\
**Category:** Kibana\
**Created:** [March 18, 2024, 8:45pm UTC](https://discuss.elastic.co/t/set-up-elk-stack-and-can-only-see-json-when-i-browse-to-it/355658 "2024-03-18T20:45:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vickistan](https://avatars.discourse-cdn.com/v4/letter/v/94ad74/32.png) [@Vickistan](https://discuss.elastic.co/u/Vickistan)\
**Post date:** [March 18, 2024, 8:45pm UTC](https://discuss.elastic.co/t/set-up-elk-stack-and-can-only-see-json-when-i-browse-to-it/355658/1 "2024-03-18T20:45:53Z")

</div>

Hey, I am very new to ELK, and I set up a stack using this:

> **[How To Install Elasticsearch, Logstash, and Kibana (Elastic Stack) on Ubuntu...](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-ubuntu-22-04)**
>
> In this tutorial, we will go over the installation of the Elastic Stack on an Ubuntu 22.04 server. You will learn how to install all of the components of the…

I am on a VM running Ubuntu 22.04. Everything comes up without errors, but when I browse to [https://ubuntu.elk.mydomain.com](https://ubuntu.elk.mydomain.com), I don't get a Kibana dashboard but rather a json blob:

```{"host":"ubuntu-elk","version":"7.17.3","http_address":"127.0.0.1:9600","id":"0afe2de1-c4e7452e-8a86-a535f88c3cfe","name":"ubuntu-elk","ephemeral_id":"27b14d5a-1705-490d-b738-82cc8c85b75e","status":"green","snapshot":false,"pipeline":{"workers":2,"batch_size":125,"batch_delay":50},"build_date":"2022-04-19T08:13:07Z","build_sha":"475c7c89406b90ee03d0efd2e304d2da455589c2","build_snapshot":false}`

I don't know what I did wrong. I have the following in nginx' kibana.conf:

```auto
server {
       listen [::]:80;
       server_name ubuntu-elk.mydomain.com www.ubuntu-elk.mydomain.com;
       return 301 https://ubuntu-elk.mydomain.com;

       auth_basic "Restricted Access";
       auth_basic_user_file /etc/nginx/htpasswd.users;
   
       location / {
           proxy_pass http://127.0.0.1:9600;
           #proxy_pass http://127.0.0.1:5601;
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection 'upgrade';
           proxy_set_header Host $host;
           proxy_cache_bypass $http_upgrade;
       }
}

server {
    listen 443 ssl;

    server_name ubuntu-elk.mydomain.com www.ubuntu-elk.mydomain.com;

    add_header Strict-Transport-Security "max-age=31536000";

    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/htpasswd.users;

    ssl_certificate /etc/letsencrypt/live/mydomain.com/ubuntu-elk.mydomain.com.crt;
    ssl_certificate_key /etc/letsencrypt/live/mydomain.com/ubuntu-elk.mydomain.com.key;
    ssl_stapling on;
    ssl_stapling_verify on;

    access_log /var/log/nginx/sub.log combined;

    #location /.well-known {
    # alias /[MY PATH]/.well-known;
    #}

    location / {
        proxy_pass http://127.0.0.1:9600;
        #proxy_pass http://127.0.0.1:5601;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header X-Forwarded-For $remote_addr;
    }
}

```

Can I buy a vowel?

Vickistan

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [March 19, 2024, 10:13am UTC](https://discuss.elastic.co/t/set-up-elk-stack-and-can-only-see-json-when-i-browse-to-it/355658/2 "2024-03-19T10:13:23Z")

</div>

Hi @Vickistan,

This looks to be an old tutorial since it's using 7.7.1 which is an old version of Elastic. But having a quick scan I see you have the proxy set to port 9600 rather than the default of 5601:

> [@Vickistan](#):
>
> ` proxy_pass http://127.0.0.1:9600;`

Can you check if you have changed the default Kibana port somewhere in your configuration? If not I think the commented out line is correct.

Is the blob above what you receive when you go to the status page as the tutorial suggests? I would also recommend having a look at the [Kibana setup and access documentation](https://www.elastic.co/guide/en/kibana/current/setup.html).

Hope that helps!

---

<div class="post-metadata">

**Author:** ![Vickistan](https://avatars.discourse-cdn.com/v4/letter/v/94ad74/32.png) [@Vickistan](https://discuss.elastic.co/u/Vickistan)\
**Post date:** [March 19, 2024, 6:54pm UTC](https://discuss.elastic.co/t/set-up-elk-stack-and-can-only-see-json-when-i-browse-to-it/355658/3 "2024-03-19T18:54:31Z")

</div>

Hi @carly.richmond

I think you are right. I was mistaking logstash which runs on port 9600 for kibana. Kibana was constantly restarting due to a fatal error when trying to access the cert key. I have fixed that, and now I am getting "Elastic did not load properly. Check the server output for more information." Working through that now. Thanks for your assistance.

Vickistan

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2024, 6:54pm UTC](https://discuss.elastic.co/t/set-up-elk-stack-and-can-only-see-json-when-i-browse-to-it/355658/4 "2024-04-16T18:54:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.