Elastic stack Azure Kibana fails with 99% cpu

Elastic Stack Kibana
1

Today I created a single node elasticsearch + kibana 6.2.2 deployment on azure. When everything was done provisioning, I noticed the CPU was pegged on the kibana VM. I connected over ssh and found that I had to remove the xpack lines from kibana.yml because it just repeated this forever:
{"type":"log","@timestamp":"2018-03-07T04:19:58Z","tags":["fatal"],"pid":32
589,"message":""xpack.security.encryptionKey" and "xpack.reporting.encry
ptionKey" settings were not applied. Check for spelling errors and ensure
that expected plugins are installed and enabled."}

After commenting out those lines I was able to start kibana and load the UI. I haven't dug into xpack plugin issue any more (it's bed time) but my expectation is that it would have worked without intervention.

2

The config keys look correct, but the errors indicate that x-pack wasn't installed. Were you expecting x-pack to be installed/can you share your installation steps? Was this using the Azure marketplace offering?

3

Yes it was using the marketplace. I filled in all of the fields, only change from defaults being I changed 3 nodes to 1 and elected for no dedicated master nodes. From the description on the marketplace it suggests xpack would be installed with a 30 day trial, and I don't remember seeing any option to opt out of that. I would be confused though as to why it would install it in elastic and not in kibana. I would be willing to let you ssh in and look at any logs you think might help.

4

I would have to escalate, I can tell you what's wrong on the Kibana side but not why the Azure setup didn't install as expected.

It's possible the CPU was pegged when installing x-pack, and the server went OOM. Is there a support line in Azure, and if so could you include the information in this thread?

5

I thought that maybe the elastic Microsoft team managed that template. It's not terribly important to me at this point, was more trying it out and ran into this issue and figured I'd alert you.

Thanks for the reply

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.