Hello, I'm climbing trying a cluster without elastic.
After installing elasticsearch and editing the elasticsearch.yml file, I start each machine in the cluster.
However, when doing a curl to check the cluster I receive this error.
The password I am using is correct.
{
"error" : {
"root_cause" : [
{
"type" : "security_exception",
"reason" : "unable to authenticate user [elastic] for REST request [/_cluster/health?pretty]",
"header" : {
"WWW-Authenticate" : [
"Basic realm=\"security\", charset=\"UTF-8\"",
"Bearer realm=\"security\"",
"ApiKey"
]
}
}
],
"type" : "security_exception",
"reason" : "unable to authenticate user [elastic] for REST request [/_cluster/health?pretty]",
"header" : {
"WWW-Authenticate" : [
"Basic realm=\"security\", charset=\"UTF-8\"",
"Bearer realm=\"security\"",
"ApiKey"
]
}
},
"status" : 401
}
My elasticsearch.yml file looks like this:
------------- elasticsearch.yml
cluster.name: elk-cluster
node.name: elk-master-01.environment.int
node.roles: [ master, remote_cluster_client]
network.host: 0.0.0.0
http.port: 9200
discovery.seed_providers: file
cluster.initial_master_nodes: ["elk-master-01.environment.int","elk-master-02.environment.int","elk-master-03.environment.int"]
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: /etc/elasticsearch/certs/p-elk.key
xpack.security.transport.ssl.certificate: /etc/elasticsearch/certs/p-elk.crt
xpack.security.transport.ssl.certificate_authorities: [ "/etc/elasticsearch/certs/ca/ca.crt" ]
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: /etc/elasticsearch/certs/p-elk.key
xpack.security.http.ssl.certificate: /etc/elasticsearch/certs/p-elk.crt
xpack.security.http.ssl.certificate_authorities: [ "/etc/elasticsearch/certs/ca/ca.crt" ]
The cluster log looks like this:
[2025-02-27T02:28:29,309][INFO ][o.e.x.s.a.TokenService ] [elk-master-01.environment.int] refresh keys
[2025-02-27T02:28:29,598][INFO ][o.e.x.s.a.TokenService ] [elk-master-01.environment.int] refreshed keys
[2025-02-27T02:28:29,676][INFO ][o.e.x.s.a.Realms ] [elk-master-01.environment.int] license mode is [basic], currently licensed security realms are [reserved/reserved,file/default_file,native/default_native]
[2025-02-27T02:28:29,681][INFO ][o.e.l.ClusterStateLicenseService] [elk-master-01.environment.int] license [1d71782d-d019-481c-969f-c4ce49bce2f8] mode [basic] - valid
[2025-02-27T02:28:29,699][INFO ][o.e.h.AbstractHttpServerTransport] [dataprod-elk-master-01.environment.int] publish_address {10.47.150.40:9200}, bound_addresses {0.0.0.0:9200}
[2025-02-27T02:28:29,766][INFO ][o.e.n.Node ] [elk-master-01.environment.int] started {elk-master-01.environment.int}{vq70NQJ6Sei-OFSrZuTDYQ}{E7vXIwkeQdqrhIauLvj78A}{elk-master-01.environment.int}{10.47.150.40}{10.47.150.40:9300}{mr}{8.17.2}{7000099-8521000}{ml.config_version=12.0.0, xpack.installed=true, transform.config_version=10.0.0}
[2025-02-27T02:28:29,775][INFO ][o.e.n.j.JdkPosixCLibrary ] [elk-master-01.environment.int] Sending 7 bytes to socket
[2025-02-27T02:29:13,644][ERROR][o.e.x.s.a.e.ReservedRealm] [elk-master-01.environment.int] failed to retrieve password hash for reserved user [elastic]
org.elasticsearch.action.UnavailableShardsException: at least one primary shard for the index [.security-7] is unavailable
[2025-02-27T02:29:13,665][INFO ][o.e.x.s.a.RealmsAuthenticator] [elk-master-01.environment.int] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]