# Elasticsearch output - ILM availablity not properly detected with expired ES license **URL:** \ **Category:** Logstash\ **Tags:** license, ilm-index-lifecycle-management\ **Created:** [February 18, 2021, 1:50pm UTC](https://discuss.elastic.co/t/elasticsearch-output-ilm-availablity-not-properly-detected-with-expired-es-license/264709 "2021-02-18T13:50:25Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![SH\_HSOC](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@SH\_HSOC](https://discuss.elastic.co/u/SH_HSOC)\ **Post date:** [February 18, 2021, 1:50pm UTC](https://discuss.elastic.co/t/elasticsearch-output-ilm-availablity-not-properly-detected-with-expired-es-license/264709/1 "2021-02-18T13:50:25Z")
Hi community, I think I discovered a corner case bug in the elasticsearch output plugin. Currently the license of my elasticsearch cluster has expired and it feels like the ILM availability is no longer properly detected by the output plugin. My config looks like this: ```auto output { elasticsearch { hosts => ["host1", "host2"] ilm_rollover_alias => "my-specific-alias" ilm_pattern => "{now/d}-000001" ilm_policy => "specific_alias_lifecycle" user => "user" password => "password" } } ``` I know that the lifecycle feature is not disabled due to the expired license, because my indices still get cycled through. After restarting one of my logstash nodes though, this one is not able to detect ILM feature and therefore ships my data to the default logstash-\* index instead. In the logs I see this: ```auto New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["host1", "host2"]} Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled} Index Lifecycle Management is set to 'auto', but will be disabled - Index Lifecycle management is not available in your Elasticsearch cluster Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{...}}} ``` Does anybody ever have seen this? Is it maybe a bug in [logstash-output-elasticsearch/ilm.rb at master · logstash-plugins/logstash-output-elasticsearch · GitHub](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/ilm.rb)? It's not a big issue for myself, since I will refresh my license in the next days, but with ILM being a feature, which is not degraded by an expired license, this is at least unexpected. Best regards, Sebastian ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 18, 2021, 5:05pm UTC](https://discuss.elastic.co/t/elasticsearch-output-ilm-availablity-not-properly-detected-with-expired-es-license/264709/2 "2021-02-18T17:05:20Z")
The elasticsearch output [makes a request](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/bcfc364dd88bdc5a31060b90253e0cbfa21ba593/lib/logstash/outputs/elasticsearch/ilm.rb#L57) to ES for "/\_xpack", which it assumes contains JSON. It expects both the 'available' and 'enabled' fields to be 'true' in that JSON. If ES does not set them to true when a licence expires I think that would be an ES bug. ---
**Author:** ![SH\_HSOC](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@SH\_HSOC](https://discuss.elastic.co/u/SH_HSOC)\ **Post date:** [February 18, 2021, 5:57pm UTC](https://discuss.elastic.co/t/elasticsearch-output-ilm-availablity-not-properly-detected-with-expired-es-license/264709/3 "2021-02-18T17:57:16Z")
Well, then this is the issue. I get the following JSON back ```auto { "build":{"hash":"foo","date":"timestamp"}, "license":{"uid":"bar","type":"platinum","mode":"platinum","status":"expired","expiry_date_in_millis":123456890}, "features":{ "analytics":{"available":false,"enabled":true}, "ccr":{"available":false,"enabled":true}, "data_streams":{"available":true,"enabled":true}, "enrich":{"available":false,"enabled":true}, "eql":{"available":false,"enabled":true}, "flattened":{"available":false,"enabled":true}, "frozen_indices":{"available":true,"enabled":true}, "graph":{"available":false,"enabled":true}, "ilm":{"available":false,"enabled":true}, "logstash":{"available":false,"enabled":true}, "ml":{"available":false,"enabled":true,"native_code_info":{"version":"7.9.1","build_hash":"abcdef"}}, "monitoring":{"available":false,"enabled":true}, "rollup":{"available":false,"enabled":true}, "security":{"available":true,"enabled":true}, "slm":{"available":false,"enabled":true}, "spatial":{"available":false,"enabled":true}, "sql":{"available":false,"enabled":true}, "transform":{"available":false,"enabled":true}, "vectors":{"available":false,"enabled":true}, "voting_only":{"available":false,"enabled":true}, "watcher":{"available":false,"enabled":false} }, "tagline":"You know, for X" } ``` This strikes me odd though. As far as I can tell from [License expiration](https://www.elastic.co/guide/en/kibana/master/managing-licenses.html#license-expiration), it is not something, which should be degraded. And the feature itself certainly is running. My indices still properly cycle through their intended lifecycle. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 18, 2021, 6:11pm UTC](https://discuss.elastic.co/t/elasticsearch-output-ilm-availablity-not-properly-detected-with-expired-es-license/264709/4 "2021-02-18T18:11:50Z")
It may just be an elasticsearch bug. You might get an answer if you post that JSON in the elasticsearch forum and ask why available is false for ilm when the licence is expired. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 18, 2021, 6:12pm UTC](https://discuss.elastic.co/t/elasticsearch-output-ilm-availablity-not-properly-detected-with-expired-es-license/264709/5 "2021-03-18T18:12:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.