# Kibana Returns "Connection Failed"

The "Connection Failed" error in Kibana typically indicates an issue with Kibana's ability to connect to Elasticsearch. This can happen due to several reasons, ranging from Elasticsearch being down, incorrect configurations in Kibana, or networking issues.

### Steps to Troubleshoot "Connection Failed" in Kibana

### 1. **Check Elasticsearch Status**

- **Ensure Elasticsearch is running**: Kibana relies on Elasticsearch, so the first step is to check if your Elasticsearch instance is up and running.

On the Elasticsearch server, run:

```bash
curl <http://localhost:9200>
```

This should return a response with details about your Elasticsearch cluster, including its health. If you get no response or an error, it indicates Elasticsearch is not running or is inaccessible.

- **Check Elasticsearch logs**: Elasticsearch logs may contain useful information if it's not running correctly. The logs can be found in the following directory (depending on your installation):
    - `/var/log/elasticsearch/`
    - `/usr/share/elasticsearch/logs/`

Check for any errors or issues that might be causing Elasticsearch to fail.

### 2. **Check Kibana Configuration**

Open Kibana's configuration file (usually located at `/etc/kibana/kibana.yml` or in the directory where Kibana is installed) and verify that the Elasticsearch URL is correct.

Key settings to check:

```yaml
# URL for the Elasticsearch instance Kibana connects to
elasticsearch.hosts: ["<http://localhost:9200>"]
```

- If Elasticsearch is running on a different host or port, adjust the URL accordingly.
- If Elasticsearch is running over HTTPS, ensure you have the correct configuration for SSL:
    
    ```yaml
    elasticsearch.hosts: ["<https://localhost:9200>"]
    elasticsearch.ssl.verificationMode: none  # Use 'none' if SSL verification is causing issues
    ```
    

After making changes, restart Kibana:

```bash
sudo systemctl restart kibana
```

### 3. **Check Firewall or Networking Issues**

- **Ports**: Kibana needs to be able to communicate with Elasticsearch over port 9200 (default for Elasticsearch). Make sure there is no firewall blocking the connection between Kibana and Elasticsearch.
    
    You can use `telnet` or `curl` to check the connection from the Kibana server to Elasticsearch:
    
    ```bash
    curl -I http://<elasticsearch-ip>:9200
    ```
    
    If this doesn’t work, you might have a networking issue (firewall, proxy, etc.).
    
- **Elasticsearch network settings**: Ensure that Elasticsearch is bound to the correct IP address or network interface so that Kibana can access it. Check the following in your Elasticsearch configuration (`elasticsearch.yml`):
    
    ```yaml
    network.host: 0.0.0.0
    ```
    
    This will bind Elasticsearch to all available network interfaces. You can restrict it to a specific IP address if needed.
    

### 4. **Check for Version Mismatch**

Kibana must be compatible with the Elasticsearch version. Running different versions of Kibana and Elasticsearch can cause connectivity issues.

You can check the Elasticsearch version via:

```bash
curl <http://localhost:9200> | grep version
```

And compare that to Kibana’s version. If there’s a version mismatch, you might need to upgrade or downgrade either Kibana or Elasticsearch.

### 5. **Check Elasticsearch Cluster Health**

Kibana may not connect if the Elasticsearch cluster is in a `red` or `yellow` state.

- Check the cluster health:
    
    ```bash
    curl <http://localhost:9200/_cluster/health?pretty>
    ```
    
- If the status is `red`, there may be shards that failed to initialize, nodes down, or other issues affecting the cluster.

### 6. **Check Kibana Logs**

The Kibana logs can provide more insight into why the connection is failing. Check the Kibana logs at:

- `/var/log/kibana/kibana.log`
- Or the logs directory in your Kibana installation.

Look for any errors or warnings related to connecting to Elasticsearch.

### 7. **Elasticsearch Authentication or Security Settings**

- **X-Pack security**: If you have X-Pack security (or any other security plugin) enabled in Elasticsearch, Kibana will need to authenticate itself when connecting. Make sure you’ve set the `elasticsearch.username` and `elasticsearch.password` fields in the Kibana config (`kibana.yml`).
    
    ```yaml
    elasticsearch.username: "kibana"
    elasticsearch.password: "your-password"
    ```
    
- **API Key Authentication**: If you're using API keys for authentication, ensure you've configured it properly in Kibana's `kibana.yml`:
    
    ```yaml
    elasticsearch.apiKey: "YOUR_API_KEY"
    ```
    

### 8. **Restart Elasticsearch and Kibana**

If the above steps don’t resolve the issue, try restarting both Elasticsearch and Kibana services.

- Restart Elasticsearch:
    
    ```bash
    sudo systemctl restart elasticsearch
    ```
    
- Restart Kibana:
    
    ```bash
    sudo systemctl restart kibana
    ```
    

### 9. **Cross-Origin Resource Sharing (CORS) Issues**

If Kibana is running on a different domain or port than Elasticsearch, you may need to configure CORS settings in Elasticsearch. In your `elasticsearch.yml`:

```yaml
http.cors.enabled: true
http.cors.allow-origin: "*"
```

This allows requests from any origin. Adjust the `allow-origin` setting to be more restrictive in production.

### Conclusion

The "Connection Failed" error usually points to either an issue with Elasticsearch being unreachable, incorrect Kibana configuration, or network/firewall issues. By checking Elasticsearch's status, reviewing your Kibana configuration, and ensuring there are no network obstacles, you should be able to resolve this issue. The logs for both Kibana and Elasticsearch are often the best source of information for diagnosing such issues.