Cluster monitoring X-Pack [security_exception] Cannot authenticate null

[rschirin (Robert)]

hi,
I'm using the Elastic stack 7.2 and I have configured the cluster xpack monitoring.
Currently I can see the indices .monitoring-es-7* but I cannot visualize them in Kibana.
I'm facing this error:

{"type":"error","@timestamp":"2019-07-19T14:36:37Z","tags":["error","monitoring"],"pid":4266,"level":"error","error":{"message":"[security_exception] Cannot authenticate null","name":"Error","stack":"[security_exception] Cannot authenticate null :: {\"path\":\"/*%3A.monitoring-es-6-*%2C*%3A.monitoring-es-7-*%2C.monitoring-es-6-*%2C.monitoring-es-7-*/_search\",\"query\":

into my kibana.yml I have configured the elastic user account so I'm quite sure it should be ok regarding permissions.

[Igor_Zaytsev]

@rschirin

Hey Roger,

I can't reproduce this, but there are few steps you can take to maybe get pass this:

1. Make sure the main default (Superuser) has turned on Monitoring for that cluster by clicking the "Turn on monitoring" button when clicking on the Stack Monitoring from the side-menu. This basically sets xpack.monitoring.collection.enabled to true

2. Make sure the user that is used in the kibana.yml has sufficient roles (monitoring_user and kibana_user), and the setup is configured correctly: https://www.elastic.co/guide/en/kibana/current/monitoring-settings-kb.html

3. Are you sure the correct user is logged into Kibana? I would do /logout (after the port number) and login with the correct user (the same user that's in the config)

4. Might also be that the indexes got corrupted somehow try deleting them by running the following query in Dev Tools:

DELETE .monitoring-*

ES should recreate the indexes after about 10 seconds

=======================================================

I'm assuming this is not using Metricbeat and is sending data directly to ESMS, otherwise look into Metricbeat user setup here: https://www.elastic.co/guide/en/elastic-stack-overview/current/monitoring-production.html

[rschirin (Robert)]

@Igor_Zaytsev
hi,
I followed your hints.

1. I cannot click on "Turn on monitoring" since I face immediately the error above.
2. in my kibana.yml I also tried with admin account
3. admin is able to login into Kibana
4. I deleted the indices but the error is the same

You are right, I'm not using Metricbeat.