1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Install of Kibana on Windows HTTP 400

Discussion in 'Install Logstash and Kibana on a Windows server.' started by Bill Stoddart, Nov 12, 2015.

  1. Bill Stoddart

    Bill Stoddart New Member Member

    Hello,

    I am new to this technology stack, but I am very excited about it. I have followed the steps in the article
    https://www.ulyaoth.net/resources/tutorial-install-logstash-and-kibana-on-a-windows-server.34/. I have all the services running. However, my Kibana site will only show the banner and sub-menus (or tabs) are not showing. It does not want to display the default index for some reason. The body of the page is blank. I am running on Windows Server 2012 R2 under IIS 8.5. I have captured the IIS logs of my last attempt to access the site. Notice the last entry returns a HTTP 400. Do you have any ideas?

    Code:
    #Software: Microsoft Internet Information Services 8.5
    #Version: 1.0
    #Date: 2015-11-12 18:22:41
    #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
    2015-11-12 18:22:41 127.0.0.1 GET / X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=12ca833a-75cd-44dc-83e9-e52c05108b3b&SERVER-STATUS=200 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 200 0 0 31
    2015-11-12 18:22:41 127.0.0.1 GET /app/kibana X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=ad1edf75-2bf3-47eb-b45f-3a8b4f696ec9&SERVER-STATUS=200 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://loghost.ulyaoth.net/ 200 0 0 0
    2015-11-12 18:22:41 127.0.0.1 GET /bundles/commons.style.css X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=a708f804-64d2-4d59-9132-b5d7a74e4759&SERVER-STATUS=304 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://loghost.ulyaoth.net/app/kibana 304 0 0 0
    2015-11-12 18:22:41 127.0.0.1 GET /bundles/commons.bundle.js X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=8267330b-38f7-4118-9cac-c877d9ff4d8b&SERVER-STATUS=304 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://loghost.ulyaoth.net/app/kibana 304 0 0 15
    2015-11-12 18:22:41 127.0.0.1 GET /bundles/kibana.style.css X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=fb395728-2879-4e0f-8bf0-451a55a2c97e&SERVER-STATUS=304 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://loghost.ulyaoth.net/app/kibana 304 0 0 78
    2015-11-12 18:22:41 127.0.0.1 GET /bundles/kibana.bundle.js X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=61cd7f1a-e065-483a-ab2a-eba0b29e0f83&SERVER-STATUS=304 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://loghost.ulyaoth.net/app/kibana 304 0 0 15
    2015-11-12 18:22:41 127.0.0.1 POST /elasticsearch/_mget timeout=0&ignore_unavailable=true&preference=1447352562152&X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=5323cd3a-0504-4df6-ab2d-8e01c95676a9&SERVER-STATUS=200 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://loghost.ulyaoth.net/app/kibana#/discover?_g=() 200 0 0 15
    2015-11-12 18:22:41 127.0.0.1 POST /elasticsearch/.kibana/index-pattern/_search fields=&X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=59b94e61-8df2-4b2c-b06c-3feac9c0438a&SERVER-STATUS=200 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://loghost.ulyaoth.net/app/kibana#/discover?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-15m,mode:quick,to:now)) 200 0 0 26
    2015-11-12 18:22:41 127.0.0.1 GET /elasticsearch/.kibana/_mapping/*/field/_source _=1447352562506 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://loghost.ulyaoth.net/app/kibana#/settings/indices/?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-15m,mode:quick,to:now)) 400 0 0 15
    I have attached what the site displays.
    kibana.PNG

    Thanks in advance.

    Bill S.
     
  2. Bill Stoddart

    Bill Stoddart New Member Member

    Update: I removed the reverse proxy and it seems to work OK. I'm not sure why that would be an issue.
     
  3. sbagmeijer

    sbagmeijer Machine

    I have never seen this before however do you run any kind of caching?
    And I assume to make the "loghost.ulyaoth.net" to work you have added things to your hosts file?

    Could you show a screenshot of your ARR and Reverse Proxy?
     

Share This Page