Apm-server failed connect to ElasticSearch with Xpack enabled (401 Unauthorized )

Elastic Observability APM
1

Hello,

ELK_VERSION = 7.2.0

On my docker environment, I can not connect apm-server with elastic Search when xpack (basic mode) is enabled. When Xpack is disabled, it's work

ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(http://elasticsearch:9200)): 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401}

While Kibana connects well with Elastic Search with Xpack (basic mode) enabled.

config/elasticsearch.yml

...
xpack.license.self_generated.type: basic
xpack.security.enabled: true

config/kibana.yml

...
xpack.security.enabled: true
elasticsearch.username: elastic
elasticsearch.password: changeme

config/apm-server.yml

apm-server:
  host: localhost:8200

output.elasticsearch:
    enabled: true
    protocol: "http"
    hosts: [ "elasticsearch:9200" ]
    ssl.enabled: false
    username: elastic
    password: changeme

How can I connect apm-server to elastic Search with Basic Authentication?

Thx !

1 Like
2

Hey @blump, thanks for joining the forum. Are you able to log into kibana with those credentials? If so, you might consider enabling security audting in elasticsearch and expect the elasticsearch logs to point you in the right direction.

I don't see anything obviously wrong with the apm-server.yml provided.

3

Hi Gil, I have the same case. Can there be a problem in the type of license?

4

Checked, the problem is not in the license.

5

Solved

6

I have the same issue!
Would you mind let us know how you solved it?

7

Can you provide your docker-compose for apm-server?

8

Actually I have this similar issue in Metricbeats with this docker-compose file:

version: "2.1"
services:
 metricbeat:
    container_name: metricbeat
    hostname: metricbeat
    user: root
    image: docker.elastic.co/beats/metricbeat:${ELASTIC_VERSION}
    volumes:
      - ./config/beats/metricbeat/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml
      - ./config/beats/metricbeat/modules.d/:/usr/share/metricbeat/modules.d/
      - /proc:/hostfs/proc:ro
      - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - /:/hostfs:ro
    command: metricbeat -e -system.hostfs=/hostfs -E output.elasticsearch.username=elastic -E output.elasticsearch.password=xxxx -strict.perms=false
    restart: on-failure
9

My problem was exactly the same as Mr. Blumb. The solution was simple, the configuration was mounted the wrong way. I do not use metricbeat. But I suggest you not to use the command to pass arguments, but to do it in the config.

10

Thanks, I have the same issue!
I removed any parameters from docker-compose command and just used config to pass arguments (elastic user and pass).

11

I did not have time to look again at this problem. I do not pass my arguments by a command. I could look again at the problem in September.

Good luck to you.

12

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.