Yes it was using the marketplace. I filled in all of the fields, only change from defaults being I changed 3 nodes to 1 and elected for no dedicated master nodes. From the description on the marketplace it suggests xpack would be installed with a 30 day trial, and I don't remember seeing any option to opt out of that. I would be confused though as to why it would install it in elastic and not in kibana. I would be willing to let you ssh in and look at any logs you think might help.