Unable to load Winlogbeat Dashboards

I am setting up the ELK stack in a test environment. My ELK server is running CentOS 7. I am running version 6.1.1 of all ELK stack components. I am using nginx as a reverse proxy to server the page to my test environment. I am using a Windows 10 machine as the test machine for WinLogBeat. When I attempt to setup the Kibana dashboards, I receive the following error message in Powershell:

"Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: fail to get the Kibana version:HTTP GET request to /api/status fails: fail to execute the HTTP GET request: Get http://[FQDN]:5601/api/status: dial tcp connectex: No connection could be made because the target machine actively refused it.. Response: ."

I can provide any/all logs upon request. Thank you.

Did you expose the Kibana endpoints through nginx?

Yes. I can reach the actual Kibana site through the FQDN I assigned, and I can receive a response from the page at :5601, but the response is "Connection Refused".

Is it a connection refused response from nginx or from the upstream service (Kibana)?

Nginx error logs seem to indicate it's from the upstream Kibana service. Here is the error in full:

"[error] 45651#0: *77 connect() failed (111: Connection refused) while connecting to upstream, client: [IP ADDRESS], server: [FQDN], request: "GET /plugins/timelion/icon.svg HTTP/1.1", upstream: "http://[::1]:5601/plugins/timelion/icon.svg", host: "[FQDN]", referrer: "http://[FQDN]/app/kibana"

Note that the "/plugins/timelion/icon.svg" is not the only element called in these errors. There are identical errors in the log except the element is different each time. For example, "http://[::1]:5601/kibana/bundlescommons.style.css?v=16350", and "http://[::1]:5601/bundles/kibana.style.css?v=16350". I'm assuming these are the dashboard elements.

It seems to be a permissions error (?), but even when I explicitly pass the Kibana credentials I created using setup.kibana.username and setup.kibana.password, I get the same response.

Any additional ideas, Andrew? Any further information I can provide to help with this? Thanks.

By default Kibana listens on localhost:5601 only. If your proxy is not running on the same host as Kibana then you will need to set the server.host to make Kibana listen on an appropriate interface (e.g. server.host:

1 Like

Got it working, thanks. Nginx was running on the same host as Kibana, but was only proxying port 80, not port 5601. By changing server.host from "localhost" to my FQDN, it allowed me to properly load the dashboards. Thank you.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.