### Author:  [@es7x](https://discuss.elastic.co/u/es7x)
#### Post date: [December 4, 2020, 8:13am UTC](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622/1 "2020-12-04T08:13:48Z")
Столкнулся с проблемой, под пользователем elastic не пускает в stack monitoring хотя до этого все работало.
в логах кибаны такое
```auto
"{ Error: [security_exception] action [indices:data/read/search[can_match]] is unauthorized for user [elastic] (and) [security_exception] action [indices:data/read/search[can_match]] is unauthorized for user [elastic] (and) [security_exception] action [indices:data/read/search[can_match]] is unauthorized for user [elastic]
at respond (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:349:15)\n at checkRespForFailure (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:306:7)
at HttpConnector. (/usr/share/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:173:7)
at IncomingMessage.wrapper (/usr/share/kibana/node_modules/lodash/lodash.js:4949:19)
at IncomingMessage.emit (events.js:203:15)
at endReadableNT (_stream_readable.js:1145:12)
at process._tickCallback (internal/process/next_tick.js:63:19)
status: 403,
displayName: 'AuthorizationException',
message:
'[security_exception] action [indices:data/read/search[can_match]] is unauthorized for user [elastic] (and) [security_exception] action [indices:data/read/search[can_match]] is unauthorized for user [elastic] (and) [security_exception] action [indices:data/read/search[can_match]] is unauthorized for user [elastic]',
path:
'/*%3A.monitoring-es-6-*%2C*%3A.monitoring-es-7-*%2C.monitoring-es-6-*%2C.monitoring-es-7-*%2Cmetricbeat-*/_search',
query:
{ size: 10000,
ignore_unavailable: true,
filter_path:
'hits.hits._index,hits.hits._source.cluster_uuid,hits.hits._source.cluster_name,hits.hits._source.version,hits.hits._source.license.status,hits.hits._source.license.type,hits.hits._source.license.issue_date,hits.hits._source.license.expiry_date,hits.hits._source.license.expiry_date_in_millis,hits.hits._source.cluster_stats,hits.hits._source.cluster_state,hits.hits._source.cluster_settings.cluster.metadata.display_name' },
body:
{ error:
{ root_cause: [Array],
type: 'search_phase_execution_exception',
reason: 'all shards failed',
phase: 'can_match',
grouped: true,
failed_shards: [Array] },
status: 403 },
statusCode: 403,
response:
'{\"error\":{\"root_cause\":[{\"type\":\"security_exception\",\"reason\":\"action [indices:data/read/search[can_match]] is unauthorized for user [elastic]\"},{\"type\":\"security_exception\",\"reason\":\"action [indices:data/read/search[can_match]] is unauthorized for user [elastic]\"},{\"type\":\"security_exception\",\"reason\":\"action [indices:data/read/search[can_match]] is unauthorized for user [elastic]\"}],\"type\":\"search_phase_execution_exception\",\"reason\":\"all shards failed\",\"phase\":\"can_match\",\"grouped\":true,\"failed_shards\":[{\"shard\":0,\"index\":\".monitoring-es-7-mb-2020.12.03\",\"node\":\"wKGpMWv-RWmsQsbT-2q9jw\",\"reason\":{\"type\":\"security_exception\",\"reason\":\"action [indices:data/read/search[can_match]] is unauthorized for user [elastic]\",\"caused_by\":{\"type\":\"illegal_state_exception\",\"reason\":\"There are no external requests known to support wildcards that don\\'t support replacing their indices\"}}},{\"shard\":0,\"index\":\".monitoring-es-7-mb-2020.12.04\",\"node\":\"0Kr0JkebTY6Ln93_uB1caA\",\"reason\":{\"type\":\"security_exception\",\"reason\":\"action [indices:data/read/search[can_match]] is unauthorized for user [elastic]\",\"caused_by\":{\"type\":\"illegal_state_exception\",\"reason\":\"There are no external requests known to support wildcards that don\\'t support replacing their indices\"}}},{\"shard\":0,\"index\":\"metricbeat-7.10.0-2020.12.03-000001\",\"node\":\"0Kr0JkebTY6Ln93_uB1caA\",\"reason\":{\"type\":\"security_exception\",\"reason\":\"action [indices:data/read/search[can_match]] is unauthorized for user [elastic]\",\"caused_by\":{\"type\":\"illegal_state_exception\",\"reason\":\"There are no external requests known to support wildcards that don\\'t support replacing their indices\"}}}]},\"status\":403}',
toString: [Function],\n toJSON: [Function] }"
```
x-pack-security: true
---
### Author:  [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)
#### Post date: [December 4, 2020, 4:00pm UTC](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622/2 "2020-12-04T16:00:57Z")
> [@es7x](#):
>
> хотя до этого все работало.
"До этого" - это до того как вы удаленный кластер добавили? Какая версия elasticsearch на этом кластере и какая на удаленном?
---
### Author:  [@es7x](https://discuss.elastic.co/u/es7x)
#### Post date: [December 4, 2020, 5:24pm UTC](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622/3 "2020-12-04T17:24:57Z")
Доброго времени, версия 7.10 сейчас, нет удаленных кластеров, но помню, что пробовал создать и не вышло, возможно где-то что-то прописалось, но куда копать увы не знаю.
---
### Author:  [@es7x](https://discuss.elastic.co/u/es7x)
#### Post date: [December 4, 2020, 5:33pm UTC](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622/4 "2020-12-04T17:33:35Z")
Да Игорь, вы оказались правы, нашел в настройках кластера упоминания о remote\_cluster ах ,удалил, и все заработало. Спасибо за помощь.
---
### Author:  [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)
#### Post date: [December 4, 2020, 5:35pm UTC](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622/5 "2020-12-04T17:35:20Z")
Вы не могли бы мне тогда помочь? Где это было? Я не могу воспроизвести. То есть удаленный кластер был сконфигурирован, но не существовал?
---
### Author:  [@es7x](https://discuss.elastic.co/u/es7x)
#### Post date: [December 4, 2020, 7:00pm UTC](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622/6 "2020-12-04T19:00:31Z")
Сейчас выполнил похожие действия создаю подключение к одноногому кластеру
```auto
{
"name" : "node-1",
"cluster_name" : "ba-es-test",
"cluster_uuid" : "366FDOPgQTGtDMABFfYE7g",
"version" : {
"number" : "6.2.3",
"build_hash" : "c59ff00",
"build_date" : "2018-03-13T10:06:29.741383Z",
"build_snapshot" : false,
"lucene_version" : "7.2.1",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
}
```
жму save на remote cluster в кибане у меня пусто
а в \_cluster/settings он у меня есть
```auto
{
"persistent" : {
"cluster" : {
"remote" : {
"ba-es-test" : {
"mode" : "sniff",
"skip_unavailable" : "false",
"node_connections" : "1",
"seeds" : [
"10.204.3.68:9300"
]
}
}
},
"xpack" : {
"monitoring" : {
"elasticsearch" : {
"collection" : {
"enabled" : "false"
}
},
"collection" : {
"enabled" : "true"
},
"history" : {
"duration" : "7d"
}
}
}
},
"transient" : { }
}
```
так же попробовал добавить конект к несуществующей ноде эффект такой-жеб в кибане пусто в настройках есть
---
### Author:  [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)
#### Post date: [December 4, 2020, 7:10pm UTC](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622/7 "2020-12-04T19:10:48Z")
> [@es7x](#):
>
> `"number" : "6.2.3",`
То есть удаленный кластер - 6.2.3, а основной 7.10.0?
---
### Author:  [@es7x](https://discuss.elastic.co/u/es7x)
#### Post date: [December 4, 2020, 7:13pm UTC](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622/8 "2020-12-04T19:13:18Z")
да, но также я пробовал добавить конект к придуманному IP эффект такой-же. Ни каких ошибок нет, в кибане пусто в настройках он появляется.
---
### Author:  [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)
#### Post date: [December 4, 2020, 7:22pm UTC](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622/9 "2020-12-04T19:22:43Z")
С 6.2.3 я получаю ошибку "version is not supported", как и ожидается. В остальных случаях, все работает, либо получаю ошибку "connection refused" если кластер не существует.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 1, 2021, 7:22pm UTC](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622/10 "2021-01-01T19:22:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.