# Error activating rule

**URL:** <https://discuss.elastic.co/t/error-activating-rule/340742>\
**Category:** Elastic Security\
**Created:** [August 14, 2023, 10:28am UTC](https://discuss.elastic.co/t/error-activating-rule/340742 "2023-08-14T10:28:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![saudmajed99](https://avatars.discourse-cdn.com/v4/letter/s/e56c9b/32.png) [@saudmajed99](https://discuss.elastic.co/u/saudmajed99)\
**Post date:** [August 14, 2023, 10:28am UTC](https://discuss.elastic.co/t/error-activating-rule/340742/1 "2023-08-14T10:28:38Z")

</div>

Hi there,

We have faced the issue when activated the rule and the appear this Error  
**Alert type siem.signals is disabled because your basic license has expired**  
My version ELK: 7.17.8  
Basic license

can you hlep me ?

---

<div class="post-metadata">

**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\
**Post date:** [August 15, 2023, 12:47pm UTC](https://discuss.elastic.co/t/error-activating-rule/340742/2 "2023-08-15T12:47:44Z")

</div>

Hi @saudmajed99 , welcome to Elastic community!

I suspect your basic license might not be active at the moment.

Can you please run this API call [Get license API | Elasticsearch Guide [7.17] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/get-license.html) and check the status of the license.

Here is an example response from that API call

```auto
{
  "license" : {
    "status" : "active",
    "uid" : "cbff45e7-c553-41f7-ae4f-9205eabd80xx",
    "type" : "trial",
    "issue_date" : "2018-10-20T22:05:12.332Z",
    "issue_date_in_millis" : 1540073112332,
    "expiry_date" : "2018-11-19T22:05:12.332Z",
    "expiry_date_in_millis" : 1542665112332,
    "max_nodes" : 1000,
    "issued_to" : "test",
    "issuer" : "elasticsearch",
    "start_date_in_millis" : -1
  }
}

```

Please, do not share here any sensitive information(issued, uid, etc). Just let us know what the status and type properties are from that response.

If it happen, status is not active and type is "basic" you can try to run this API: [Get basic status API | Elasticsearch Guide [7.17] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/get-basic-status.html)

And after try to start basic license by using this API: [Start basic API | Elasticsearch Guide [7.17] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/start-basic.html), as I was advised by relevant team.

I hope, that would help to resolve your issue  
Thanks, Vitalii

---

<div class="post-metadata">

**Author:** ![saudmajed99](https://avatars.discourse-cdn.com/v4/letter/s/e56c9b/32.png) [@saudmajed99](https://discuss.elastic.co/u/saudmajed99)\
**Post date:** [August 15, 2023, 1:03pm UTC](https://discuss.elastic.co/t/error-activating-rule/340742/3 "2023-08-15T13:03:50Z")

</div>

Hi vitalii

How to check license from server ELK

---

<div class="post-metadata">

**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\
**Post date:** [August 15, 2023, 1:21pm UTC](https://discuss.elastic.co/t/error-activating-rule/340742/4 "2023-08-15T13:21:41Z")

</div>

you can run queries either in Kibana dev console [Run Elasticsearch API requests | Kibana Guide [7.17] | Elastic](https://www.elastic.co/guide/en/kibana/7.17/console-kibana.html)

or copy query as curl from [API page](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/get-license.html)

 ![Screenshot 2023-08-15 at 14.17.59](https://us1.discourse-cdn.com/elastic/original/3X/1/1/11ab5242d98ae92d89ea10e124cf07bfd8cd592a.png)

It will target ES host. You will need just put there through setting correct url and username or edit it manually

---

<div class="post-metadata">

**Author:** ![saudmajed99](https://avatars.discourse-cdn.com/v4/letter/s/e56c9b/32.png) [@saudmajed99](https://discuss.elastic.co/u/saudmajed99)\
**Post date:** [August 15, 2023, 1:43pm UTC](https://discuss.elastic.co/t/error-activating-rule/340742/5 "2023-08-15T13:43:52Z")

</div>

Ok, I did result not active then used this command

GET /\_license/basic\_status

response: "eligible\_to\_start\_basic" : false

can you help me the solve issue

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [August 21, 2023, 6:42am UTC](https://discuss.elastic.co/t/error-activating-rule/340742/6 "2023-08-21T06:42:13Z")

</div>

It looks like something very strange is going on with your cluster's license

Can you provide the details from the `GET /_license` API call that @vitaliidm directed you to?

We need to see the actual response in order to be able to recommend next steps.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2023, 6:43am UTC](https://discuss.elastic.co/t/error-activating-rule/340742/7 "2023-09-18T06:43:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.