# How to install xpack on elasticsearch hosted on docker **URL:** \ **Category:** Elasticsearch\ **Created:** [March 28, 2018, 6:05am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858 "2018-03-28T06:05:37Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Post date:** [March 28, 2018, 6:05am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/1 "2018-03-28T06:05:37Z")
Please let me know how to install xpack on docker the elasticsearch version which I am using on docker is 5.6.8 . ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 28, 2018, 6:29am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/2 "2018-03-28T06:29:09Z")
Xpack is built in the default docker image. See [https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html) ---
**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Post date:** [March 28, 2018, 6:48am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/3 "2018-03-28T06:48:49Z")
To use the x-pack features do I need to execute the yml file if not what configurations are necessary to go ahead and start using its features. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 28, 2018, 7:04am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/4 "2018-03-28T07:04:11Z")
With this you should be ok for 30 days I think. ``` docker pull docker.elastic.co/elasticsearch/elasticsearch:5.6.8 docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:5.6.8 ``` It does not work? ---
**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Post date:** [March 28, 2018, 7:05am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/5 "2018-03-28T07:05:23Z")
my elasticsearch is working but on kibana there is no monitoring drop down ![kibana](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2f2914c7fc6a9ecbb9bf5ec64263c861f7510768.PNG) ---
**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Post date:** [March 28, 2018, 8:42am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/6 "2018-03-28T08:42:40Z")
Do I need to install x-pack for all the containers which I am using suppose I am using three different logstash containers at the same time so do I need to install for all the three. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 28, 2018, 9:18am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/7 "2018-03-28T09:18:00Z")
How are you starting Kibana? Did you install x-pack on Kibana? I'm often using the `docker-compose` which is documented here:[https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html) ---
**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Post date:** [March 28, 2018, 9:28am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/8 "2018-03-28T09:28:34Z")
I already have a compose file running at the same time is it fine if I have two compose files as in one which I have made for my containers and the other one which is there in the documentation or should I combine the two ---
**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Post date:** [March 28, 2018, 9:52am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/9 "2018-03-28T09:52:21Z")
{ "error": { "root\_cause": [ { "type": "security\_exception", "reason": "action [indices:data/read/search] is unauthorized for user [kibana]" } ], "type": "security\_exception", "reason": "action [indices:data/read/search] is unauthorized for user [kibana]" }, "status": 403 } This is the error which is prompted on kibana dev tools ---
**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Post date:** [March 28, 2018, 9:53am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/10 "2018-03-28T09:53:42Z")
curl ngauravls13:9200/\_cat/indices {"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication token for REST request [/\_cat/indices]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security\_exception","reason":"missing authentication token for REST request [/\_cat/indices]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401}% This is the error when I try o fetch the indices ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 28, 2018, 9:59am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/11 "2018-03-28T09:59:16Z")
I have no idea of what you are doing. Could you share: - All the docker compose files you are using - All the commands you run to launch that ---
**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Post date:** [March 28, 2018, 10:03am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/12 "2018-03-28T10:03:52Z")
this is my compose file for my containers version: '3' services: ls\_app: restart: on-failure:3 image: [docker.io/logstash:latest](http://docker.io/logstash:latest) command: logstash -f /logs1/logstash\_app.conf container\_name: logstash-app links: - es volumes: - ./logstash:/logs1 - /remote/backup/logs/APT/CINT:/logs ls\_fe: restart: on-failure:3 image: [docker.io/logstash:latest](http://docker.io/logstash:latest) command: logstash -f /logs1/logstash\_fe.conf container\_name: logstash-fe links: - es volumes: - ./logstash:/logs1 - /remote/backup/logs/APT/CINT:/logs ls\_httpd: restart: on-failure:3 image: [docker.io/logstash:latest](http://docker.io/logstash:latest) command: logstash -f /logs1/logstash\_httpd.conf container\_name: logstash-httpd links: - es volumes: - ./logstash:/logs1 - /remote/backup/logs/APT/CINT:/logs ``` kib: restart: on-failure:3 image: docker.io/kibana:latest container_name: kibana links: - es ports: - "5601:5601" es: restart: on-failure:3 image: docker.io/elasticsearch:latest container_name: elasticsearch ports: - "9200:9200" - "9300:9300" ``` ~ for the installation of x-pack I used this Hey, this is not a real issue but I spent time to install and configure x-pack plugin. If you are interested I can make a PR to add this into the documentation. Here is my doc: Configure X-Pack Official documentation Into elasticsearch/Dockerfile, install xpack plugin: RUN elasticsearch-plugin install x-pack Into kibana/Dockerfile, install xpack plugin: RUN kibana-plugin install x-pack Rebuild your stack: docker-compose up -d --build Generate passwords: docker exec -it elk\_elasticsearch\_1 bin/x-pack/setup-passwords auto Initiating the setup of reserved user elastic,kibana,logstash\_system passwords. The passwords will be randomly generated and printed to the console. Please confirm that you would like to continue [y/N]y Changed password for user kibana PASSWORD kibana = #j_LO_V$W+!oPFO^~tgw Changed password for user logstash\_system PASSWORD logstash\_system = HNn8Vi3g9i\_#A9c=sX%~ Changed password for user elastic PASSWORD elastic = lOHjUOb6TOGTJODRNdMg Add credentials to kibana/config/kibana.yml: elasticsearch.username: "kibana" elasticsearch.password: "" Restart Stack: docker-compose restart Login with elastic user at [http://localhost:5601](http://localhost:5601) Create a new User for logstash pipeline logstash\_gelf nvR9fKYKb2\yiQze5 Create a role and assign the index and all permissions logstash\_writer\_role Configure your pipeline output { elasticsearch { hosts =\> "elasticsearch:9200" index =\> "app-%{+YYYY.MM.dd}" user =\> logstash\_gelf password =\> "nvR9fKYKb2\yiQze5" } } Restart Stack to reload the configuration: ``` docker-compose restart ``` ---
**Author:** ![jarpy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jarpy/32/51290_2.png) [@jarpy](https://discuss.elastic.co/u/jarpy)\ **Post date:** [March 29, 2018, 3:34am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/13 "2018-03-29T03:34:26Z")
I recommend using the Docker images made by us here at Elastic. They are more current than the ones available on Docker Hub (which are deprecated) and are available with X-Pack pre-installed. [https://www.docker.elastic.co/](https://www.docker.elastic.co/) ---
**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Post date:** [March 29, 2018, 5:14am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/14 "2018-03-29T05:14:20Z")
Actually I m using version 5.6.8 of elasticsearch so the updated one which is 6.2.3 is not in the plan as of now ---
**Author:** ![jarpy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jarpy/32/51290_2.png) [@jarpy](https://discuss.elastic.co/u/jarpy)\ **Post date:** [March 29, 2018, 5:40am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/15 "2018-03-29T05:40:33Z")
No problem. You could still consider using our 5.6 image though, to avoid the trouble of installing X-Pack. ```auto docker pull docker.elastic.co/elasticsearch/elasticsearch:5.6.8 ``` ---
**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Post date:** [March 29, 2018, 6:00am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/16 "2018-03-29T06:00:57Z")
I pulled my images from here only just that i did the installation of the x-pack feature in the way as mentioned above also I have posted the errors which i m getting. There are errors 401 and 403 I am not able to get what permission problems is coming and from where is this forbidden error coming . What I feel is logstash is not able to flow data to elasticsearch but I am not able to figure out why because when I uninstall the x-pack feature everything works fine . ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 29, 2018, 6:43am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/17 "2018-03-29T06:43:29Z")
It's quite difficult for us to follow exactly what you're doing. You're posting error messages with no context about what caused them, or even which application/log file you're pulling them from. We can provide better help if you take the time to describe exactly what you're doing, what went wrong, and what was in the relevant logs/error messages. > [@](#): > > ```auto > "reason": "action [indices:data/read/search] is unauthorized for user [kibana]" > > ``` In this case, it looks like you have logged into Kibana as the `kibana` user. That's a common mistake that new users make. The _kibana_ user is the user that the Kibana application uses for its own purposes when it connects to Elasticsearch. For example, it is how Kibana can tell whether your ES server is available, and whether it has security turned on. You should not log in to Kibana as that user, because it doesn't have permission to do very much (which is intentional - it has just enough access to run Kibana but no more) You should initially login to Kibana using the `elastic` user. This is a _superuser_ that can do everything. You _can_ use that user for everything you want to do, and always login to Kibana as _elastic_, but we don't recommend it. Because that user can do everything, it can make a horrible mess of your cluster if you're not careful, and one of the benefits of X-Pack security is that it can protect you from mistakes like that. Rather, we recommend that you use the `elastic` user to login the first time, and then use the Kibana admin screens to create new, lower privileged users and roles that have just the permissions that you need, but nothing more. You can then safely use those users to do your work in Kibana, and you can always login as `elastic` if you need to make major changes. > docker exec -it elk\_elasticsearch\_1 bin/x-pack/setup-passwords auto Setup-passwords is a 6.x utility. If you are running 5.6 then that command should not exist in your container. > [@](#): > > I am not able to get what permission problems is coming and from where is this forbidden error coming . Which specific error do you mean? You've posted a few log messages and I can't keep track of what is a current problem, versus what has been solved. ---
**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Post date:** [March 29, 2018, 7:07am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/18 "2018-03-29T07:07:26Z")
I will go step by step for elasticsearch x-pack installation I got this root@61da15d80409:/usr/share/elasticsearch# elasticsearch-plugin install x-pack -\> Downloading x-pack from elastic [=================================================] 100% @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: plugin requires additional permissions @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ - java.io.FilePermission \.\pipe\* read,write - java.lang.RuntimePermission accessClassInPackage.com.sun.activation.registries - java.lang.RuntimePermission getClassLoader - java.lang.RuntimePermission setContextClassLoader - java.lang.RuntimePermission setFactory - java.net.SocketPermission \* connect,accept,resolve - java.security.SecurityPermission createPolicy.JavaPolicy - java.security.SecurityPermission getPolicy - java.security.SecurityPermission putProviderProperty.BC - java.security.SecurityPermission setPolicy - java.util.PropertyPermission \* read,write - javax.net.ssl.SSLPermission setHostnameVerifier See [http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html](http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html) for descriptions of what these permissions allow and the associated risks. Continue with installation? [y/N] ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 26, 2018, 7:07am UTC](https://discuss.elastic.co/t/how-to-install-xpack-on-elasticsearch-hosted-on-docker/125858/19 "2018-04-26T07:07:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.