Disable logstash license check?

Elastic Stack Logstash
1

Hi!

I am trying to connect a logstash instance to an elasticseach which is part of a deployment of IBM Cloudpak for AIOps. It uses an elasticsearch instance to store related incident data from ticket systems. The version of Elasticsearch running on the Cloudpak is version 7.17.9. Now I cannot change the version of Elasticsearch as it is part of the Cloudpak installation and I cannot change the allowed APIs either.

[2023-08-28T01:15:18,728][ERROR][logstash.outputs.elasticsearch][main] Unable to get license information {:url=>"https://elasticsearch-admin:xxxxxx@iaf-system-es-cp4waiops.apps.aiopscelde.cp.fyre.ibm.com:443/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '403' contacting Elasticsearch at URL 'https://iaf-system-es-cp4waiops.apps.aiopscelde.cp.fyre.ibm.com:443/_license'"}
[2023-08-28T01:15:18,729][ERROR][logstash.outputs.elasticsearch][main] Could not connect to a compatible version of Elasticsearch {:url=>"https://elasticsearch-admin:xxxxxx@iaf-system-es-cp4waiops.apps.aiopscelde.cp.fyre.ibm.com:443/"}

Is there a way to disable the license checking on the logstash so it can freely send information to the Elasticsearch, as I am quite limited when it comes to changing anything on the Elasticsearch side.

2

Hi @jacobdanielrose Welcome to the community.

1st please do not try to disable the license check, that is not allowed, and violates the terms of use.

A couple of things to check..

sometimes the errors can be a bit misleading... Are you sure you are connected to elasticsearch at all?

I see https are these self-signed certs?

Can you share your logstash output section?

Exactly What version / distribution of Logstash are you running? Any plugins?

Can you check this and share the results?

Also the 403 may indicate that your user does not have the correct privileges.

the -v will check the SSL certs as well.

curl -v -u elasticsearch-admin:xxxxxx https://iaf-system-es-cp4waiops.apps.aiopscelde.cp.fyre.ibm.com:443/_license

Also are you trying to Monitor Logstash... with the legacy methods This error can come from that as well.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.