Dashboard not working

[Le Sok]

Hello team, 
Today I met some problem I can't connect to wazuh dashboard
here is logs:

Jan 10 14:27:20 wazuh-server opensearch-dashboards[3667]: {"type":"log","@timestamp":"2024-01-10T14:27:20Z","tags":["error","opensearch","data"],"pid":3667,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 10 14:27:22 wazuh-server opensearch-dashboards[3667]: {"type":"log","@timestamp":"2024-01-10T14:27:22Z","tags":["error","opensearch","data"],"pid":3667,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 10 14:27:25 wazuh-server opensearch-dashboards[3667]: {"type":"log","@timestamp":"2024-01-10T14:27:25Z","tags":["error","opensearch","data"],"pid":3667,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 10 14:27:27 wazuh-server opensearch-dashboards[3667]: {"type":"log","@timestamp":"2024-01-10T14:27:27Z","tags":["error","opensearch","data"],"pid":3667,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 10 14:27:30 wazuh-server opensearch-dashboards[3667]: {"type":"log","@timestamp":"2024-01-10T14:27:30Z","tags":["error","opensearch","data"],"pid":3667,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 10 14:27:32 wazuh-server opensearch-dashboards[3667]: {"type":"log","@timestamp":"2024-01-10T14:27:32Z","tags":["error","opensearch","data"],"pid":3667,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 10 14:27:35 wazuh-server opensearch-dashboards[3667]: {"type":"log","@timestamp":"2024-01-10T14:27:35Z","tags":["error","opensearch","data"],"pid":3667,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}

Please help me.
Best regards,

[Stuti Gupta]

Hi Le sok
Hope you are doing well and thank you for using wazuh.

Can you please share the following details to know the root cause of the issue?
Please share the OS details and the correct version of wazuh.
Can you please let us know if this is a fresh installation or not and if you followed any steps before getting this error?
Please verify if there are alerts in the Wazuh indexer and share the output of the following command:
# curl https://<WAZUH_INDEXER_IP>:9200/_cat/indices/wazuh-alerts-* -u <wazuh_indexer_user>:<wazuh_indexer_password> -k
Please ensure that Filebeat is correctly configured, run the following command:
# filebeat test output
Please verify if the Wazuh API is running, try to fetch data using the CLI from the Wazuh dashboard server:
# curl -k -X GET "https://<api_url>:55000/" -H "Authorization: Bearer $(curl -u <api_user>:<api_password> -k -X POST 'https://<api_url>:55000/security/user/authenticate?raw=true')"
Can you please restart and check the status of wazuh components.
Please share the following log files:
Wazuh indexer:
# cat /var/log/wazuh-indexer/wazuh-cluster.log |
Wazuh dashboard:
# cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log
Can you please verify if you have enough space in wazuh-server for that, you can use the command:
Free -h
df -h

Hope to hear from you soon.
Regards,

[Le Sok]

I install Wazuh 4.5 OVA https://github.com/wazuh/wazuh/issues/18190
curl: (7) Failed to connect to (ip address) port 9200 after 3057 ms: Couldn't connect to server
#filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... ERROR dial tcp 127.0.0.1:9200: connect: connection refused

#Wazuh indexer:
 [node-1] loaded plugin [opensearch-performance-analyzer]
[2024-01-10T14:24:19,860][INFO ][o.o.p.PluginsService     ] [node-1] loaded plugin [opensearch-reports-scheduler]
[2024-01-10T14:24:19,861][INFO ][o.o.p.PluginsService     ] [node-1] loaded plugin [opensearch-security]
[2024-01-10T14:24:19,861][INFO ][o.o.p.PluginsService     ] [node-1] loaded plugin [opensearch-security-analytics]
[2024-01-10T14:24:19,861][INFO ][o.o.p.PluginsService     ] [node-1] loaded plugin [opensearch-sql]
[2024-01-10T14:24:21,202][INFO ][o.o.s.OpenSearchSecurityPlugin] [node-1] Disabled https compression by default to mitigate BREACH attacks. You can enable it by setting 'http.compression: true' in opensearch.yml
[2024-01-10T14:24:21,907][INFO ][o.o.e.NodeEnvironment    ] [node-1] using [1] data paths, mounts [[/ (/dev/sda1)]], net usable_space [45.5gb], net total_space [49.9gb], types [xfs]
[2024-01-10T14:24:21,907][INFO ][o.o.e.NodeEnvironment    ] [node-1] heap size [1.9gb], compressed ordinary object pointers [true]
[2024-01-10T14:24:28,878][INFO ][o.o.n.Node               ] [node-1] node name [node-1], node ID [g4kypsR3Siysbpf1I5Zqbw], cluster name [wazuh-cluster], roles [ingest, remote_cluster_client, data, cluster_manager]

cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log
{"date":"2023-07-31T13:37:24.754Z","level":"info","location":"initialize","message":"Wazuh dashboard index: .kibana"}
{"date":"2023-07-31T13:37:24.755Z","level":"info","location":"initialize","message":"App revision: 02"}
{"date":"2023-07-31T13:37:24.755Z","level":"info","location":"initialize","message":"Total RAM: 16026MB"}
{"date":"2023-07-31T13:37:37.430Z","level":"info","location":"initialize","message":"Wazuh dashboard index: .kibana"}
{"date":"2023-07-31T13:37:37.431Z","level":"info","location":"initialize","message":"App revision: 02"}
{"date":"2023-07-31T13:37:37.431Z","level":"info","location":"initialize","message":"Total RAM: 16026MB"}
 df -h
Filesystem      Size  Used Avail Use% Mounted on
devtmpfs        2.0G     0  2.0G   0% /dev
tmpfs           2.0G   60K  2.0G   1% /dev/shm
tmpfs           2.0G   17M  2.0G   1% /run
tmpfs           2.0G     0  2.0G   0% /sys/fs/cgroup
/dev/sda1        50G  4.5G   46G   9% /
tmpfs           394M     0  394M   0% /run/user/1000

[Stuti Gupta]

Hi again,

Please verify if you followed the steps mentioned in https://documentation.wazuh.com/current/deployment-options/virtual-machine/virtual-machine.html and https://documentation.wazuh.com/4.5/development/packaging/generate-ova.html#creating-the-wazuh-vm when you deploy wazuh using OVA.

[Le Sok]

I still meet this issue sir 
{"type":"log","@timestamp":"2024-01-11T08:10:54Z","tags":["error","opensearch","data"],"pid":3763,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200

[Stuti Gupta]

Hi Le sok 

I have tested this docment and it is working fine as you can see in the image:




To investigate your issue please provide logs that you get after reinstalling the wazuh OVA virtual machine 

Wazuh indexer:
# cat /var/log/wazuh-indexer/wazuh-cluster.log |
Wazuh dashboard:
# cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log

Please share the steps that you followed to install the wazuh using OVA machine

Hope to hear from you soon.
Regards,