Unable to load Winlogbeat Dashboards

(Chris Bosman) #1

I am setting up the ELK stack in a test environment. My ELK server is running CentOS 7. I am running version 6.1.1 of all ELK stack components. I am using nginx as a reverse proxy to server the page to my test environment. I am using a Windows 10 machine as the test machine for WinLogBeat. When I attempt to setup the Kibana dashboards, I receive the following error message in Powershell:

"Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: fail to get the Kibana version:HTTP GET request to /api/status fails: fail to execute the HTTP GET request: Get http://[FQDN]:5601/api/status: dial tcp connectex: No connection could be made because the target machine actively refused it.. Response: ."

I can provide any/all logs upon request. Thank you.

(Andrew Kroh) #2

Did you expose the Kibana endpoints through nginx?

(Chris Bosman) #3

Yes. I can reach the actual Kibana site through the FQDN I assigned, and I can receive a response from the page at :5601, but the response is "Connection Refused".

(Andrew Kroh) #4

Is it a connection refused response from nginx or from the upstream service (Kibana)?

(Chris Bosman) #5

Nginx error logs seem to indicate it's from the upstream Kibana service. Here is the error in full:

"[error] 45651#0: *77 connect() failed (111: Connection refused) while connecting to upstream, client: [IP ADDRESS], server: [FQDN], request: "GET /plugins/timelion/icon.svg HTTP/1.1", upstream: "http://[::1]:5601/plugins/timelion/icon.svg", host: "[FQDN]", referrer: "http://[FQDN]/app/kibana"

Note that the "/plugins/timelion/icon.svg" is not the only element called in these errors. There are identical errors in the log except the element is different each time. For example, "http://[::1]:5601/kibana/bundlescommons.style.css?v=16350", and "http://[::1]:5601/bundles/kibana.style.css?v=16350". I'm assuming these are the dashboard elements.

It seems to be a permissions error (?), but even when I explicitly pass the Kibana credentials I created using setup.kibana.username and setup.kibana.password, I get the same response.

(Chris Bosman) #6

Any additional ideas, Andrew? Any further information I can provide to help with this? Thanks.

(Andrew Kroh) #7

By default Kibana listens on localhost:5601 only. If your proxy is not running on the same host as Kibana then you will need to set the server.host to make Kibana listen on an appropriate interface (e.g. server.host:

(Chris Bosman) #8

Got it working, thanks. Nginx was running on the same host as Kibana, but was only proxying port 80, not port 5601. By changing server.host from "localhost" to my FQDN, it allowed me to properly load the dashboards. Thank you.

(system) #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.