# Can't Authenticate Kibana to Elasticsearch
**URL:** https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548
**Category:** Kibana
**Created:** [December 6, 2017, 5:23pm UTC](https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548 "2017-12-06T17:23:30Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)
#### Post date: [December 6, 2017, 5:23pm UTC](https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548/1 "2017-12-06T17:23:30Z")
Running ELK version 6.0 on Ubuntu 16.0.4 LTS virtual machine.
I have run through the X-Pack setup guide and created the passwords for: elastic, kibana and logstash\_system. I then added the kibana username and password to the kibana.yml file under elasticsearch.username and elasticsearch.password, I then restarted ES and Kibana. Now when I go to the Kibana web interface I am not asked for login (I thought X-Pack would?).
I see this in Kibana:
> Elasticsearch plugin is red
> Unable to connect to Elasticsearch at [http://localhost:9200](http://localhost:9200).
I see the below in the ES logs:
> [2017-12-06T17:14:58,706][ERROR][o.e.x.s.a.e.ReservedRealm] [WSkSjG5] failed to retrieve password hash for reserved user [kibana]
> [2017-12-06T17:14:58,706][INFO][o.e.x.s.a.AuthenticationService] [WSkSjG5] Authentication of [kibana] was terminated by realm [reserved] - failed to authenticate user [kibana]
Also I try to setup Kibana so it can log by adding /var/log/kibana/kibana.log to the logging dest option. I have created the kibana folder and set permissions to 655 and also created the kibana.log file and set the permissions to 644. When I save the config and try to start Kibana, it just keeps restarting.
Cheers
George
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [December 6, 2017, 8:10pm UTC](https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548/2 "2017-12-06T20:10:50Z")
Hi George,
Did you install X-Pack in Kibana as well as Elasticsearch ? If you're not getting prompted for a login from Kibana that would be my first guess of the problem.
[https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html](https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html)
Regards,
Lee
---
### Author:  [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)
#### Post date: [December 6, 2017, 11:07pm UTC](https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548/3 "2017-12-06T23:07:19Z")
Hi LeeDr,
I also thought this may be the issue, but I checked the version in Kibana, Logstash and Elasticsearch. Each came back as 6.0 so I'm unsure what the issue is. I may just fully reinstall ELK.
Cheers
George
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [December 6, 2017, 11:22pm UTC](https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548/4 "2017-12-06T23:22:42Z")
You could just run;
`bin/kibana-plugin list`
and verify it returns something like `x-pack@6.0.0` to verify it was installed. If you installed x-pack while Kibana was running you would need to restart it and wait for an optimizing step to complete (which can take several minutes).
---
### Author:  [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)
#### Post date: [December 6, 2017, 11:34pm UTC](https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548/5 "2017-12-06T23:34:54Z")
That was the command I used and it did return something like you stated. Kibana was stopped when I installed and the optimization of browser bundles took about 20 minutes.
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [December 6, 2017, 11:36pm UTC](https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548/6 "2017-12-06T23:36:57Z")
> [@MultiplierMultiplier](#):
>
> ```
> [2017-12-06T17:14:58,706][ERROR][o.e.x.s.a.e.ReservedRealm] [WSkSjG5]
> failed to retrieve password hash for reserved user [kibana]
>
> ```
This is the key.
Was there any more infomation before or after that line? It is an indication that X-Pack security was unable to retrieve data from your cluster for some reason, and it _should_ have more information that explains the problem (depending on the type of the problem is _could_ be immediately before or immediately after that message).
There are a few possibilities for why that probably might be including:
1. Your cluster is **red** for some reason and the security index isn't available
2. Your security index was created on a 5.x version of elasticsearch and hasn't been upgraded
What happens if you try the following:
```auto
curl -uelastic 'http://localhost:9200/'
```
You will need the `elastic` password from when you configured the passwords.
---
### Author:  [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)
#### Post date: [December 7, 2017, 9:30am UTC](https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548/7 "2017-12-07T09:30:35Z")
A few days ago I deleted all of the indices, I am new to ELK and from my previous experience with Graylog and Elastisearch the indices just held our log data that we had shipped into Elastisearch. From what I now understand, these indices hold other information used for the running of ELK. Is there anyway to rebuild the security index?
```
failed to retrieve built in user [kibana] info
org.elasticsearch.action.NoShardAvailableActionException: No shard available for [get [.security][doc][reserved-user-kibana]: routing [null]]
```
When I run the curl command you suggested I am prompted for the elastic user password and I input the password I set and it works, below is the output. I have set this username and password combination in the kibana.yml and also tried the kibana username and password I set but they didn't allow Kibana to authenticate to Elasticsearch.
```
curl -uelastic 'http://localhost:9200/'
"cluster_uuid" : "13slUMBySJeMGU46kFU7cw",
"version" : {
"number" : "6.0.0",
"build_hash" : "8f0685b",
"build_date" : "2017-11-10T18:41:22.859Z",
"build_snapshot" : false,
"lucene_version" : "7.0.1",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
}
```
Cheers,
George
---
### Author:  [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)
#### Post date: [December 7, 2017, 9:35am UTC](https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548/8 "2017-12-07T09:35:22Z")
Okay so I just checked to see which indices were there as I had previously ran a delete \* indices curl command. I have found that the security index seems to exist and its status is green:
`.security-6 aOu--AgTQ4-mavmqyb5yVQ 1 0 3 0 10.5kb 10.5kb`
---
### Author:  [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)
#### Post date: [December 7, 2017, 5:06pm UTC](https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548/9 "2017-12-07T17:06:29Z")
So looking further into this, I realise that log I sent previously is stating that there are no shards available. I ran the curl command to check the shards and they are all unassigned.
I have tried the below to reassign them but it throws up an error message.
```
curl -u elastic:INSERTPASSWORDHERE -XPOST "http://localhost:9200/_cluster/reroute" -H'Content-Type: application/json' -d'
{
"commands" : [ {
"allocate" : {
"index" : "*", "shard" : 0, "node" : "WSkSjG5", "allow_primary": "true"
}
}
]
}'
```
I get this error:
> { "error":{"root\_cause":[{"type":"unknown\_named\_object\_exception","reason":"Unknown AllocationCommand [allocate]","line":4,"col":24}],"type":"parsing\_exception","reason":"[cluster\_reroute] failed to parse field [commands]","line":4,"col":24,"caused\_by":{"type":"unknown\_named\_object\_exception","reason":"Unknown AllocationCommand [allocate]","line":4,"col":24}},"status":400}
Cheers,
George
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 4, 2018, 5:06pm UTC](https://discuss.elastic.co/t/cant-authenticate-kibana-to-elasticsearch/110548/10 "2018-01-04T17:06:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.