Elasticsearch.yml network.host: ip causes "Login is currently dissabled. Administrator should consult the Kibana Log"

Thank you in advance for your support!

8/25 Update: The solution was to use network.host: 0.0.0.0 in the elasticsearch.yml file.

We have a single server ELK 6.3.2 install on ubuntu 16.04 with X-Pack Authentication Enabled via a Trial license.

We have a beat that needs to access to the elasticsearchhost:9200 (internal ip address), but kibana authentication breaks whenever we make elasticsearchhost:9200 available via the network.host: ip line in elasticsearch.yml.

To get remote access to the kibana ui, in kibana.yml we set
server.host: "ipaddress"

So far so good, kibana is up and we can authenticate....

Our beat needs to communicate with elasticsearch via its IP, not localhost on port 9200, but....
in elasticsearch.yml when we set
network.host: site
or
network.host: ipaddress
or
network.host: interface
kibana generates "Login is currently dissabled. Administrator should consult the Kibana Log"

With network.host commented out kibana auth is ok, but our beat can talk to elasticsearch on 9200.
sudo netstat -natp | grep 9200
tcp 0 0 127.0.0.1:33380 127.0.0.1:9200 ESTABLISHED 25823/node
tcp 0 0 127.0.0.1:33372 127.0.0.1:9200 ESTABLISHED 25823/node
tcp 0 0 127.0.0.1:33374 127.0.0.1:9200 ESTABLISHED 25823/node
tcp 0 0 127.0.0.1:33370 127.0.0.1:9200 ESTABLISHED 25823/node

with network.host: ipaddress, site, and interface our beat can talk to elasticsearchhost:9200, but kibana generates "Login is currently dissabled. Administrator should consult the Kibana Log"
And it looks like this:
sudo netstat -natp | grep 9200
tcp6 0 0 192.168.2.2:9200 :::* LISTEN 1428/java
tcp6 0 0 192.168.2.2:9200 71.198.129.98:40496 ESTABLISHED 1428/java

We also tried transport.host: ipaddress in elasticsearch.yml and kibana is ok, but the beat can not communication to elasticsearchhost:9200.

We are also testing without xpack authentication using nginx, but we get the same results.

Thank you again for your support!

1 Like

Thanks for sharing the solution :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.