How to reset elasticsearch "elastic" user password?

Elastic Stack Elasticsearch
1

install-elasticsearch.sh

sudo dnf install -y java-17-openjdk java-17-openjdk-devel
sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
cat << EOF > /etc/yum.repos.d/elasticsearch.repo
[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF
sudo dnf install -y elasticsearch

Then,

sudo vi /etc/elasticsearch/elasticsearch.yml

cluster.name: MyCluster
node.name: mynode
path.data: /var/lib/elasticsearch
network.host: 0.0.0.0

Now, I attempted to browse elasticsearch website. However, I can't seem to find the username and password. I tried username like "elastic" and passowrd like 'changeme' 'elastic' 'admin' etc. But they didn't work.

Thus I decided to reset user password for elastic user.

ELASTIC_PASSWORD=$(sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic -b -s)
if [[ $? -eq 0 ]]; then
    echo "Elastic user password: $ELASTIC_PASSWORD"
else
    echo "Failed to reset elastic user password."
    exit 1
fi

I try to use this script but no avail.

ERROR: Failed to determine the health of the cluster. Unexpected http status [503], with exit code 65
Failed to reset elastic user password.
2

Hello,

Welcome!

When we install the elasticsearch it generates a random password which is shown on the screen during installation.
If you want to reset the password we can use the reset password script, could you please confirm if the elasticsearch is running? Once it is up & running can you try to again execute the script & see what is the error?

Thanks

3

Yes it's running And /var/log/elasticsearch/*.log isn't fishy either

[root@rocky8 ~]# systemctl status elasticsearch
● elasticsearch.service - Elasticsearch
   Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled)
   Active: active (running) since Sun 2024-12-08 23:21:12 EST; 3h 3min ago
     Docs: https://www.elastic.co
 Main PID: 877 (java)
    Tasks: 81 (limit: 14920)
   Memory: 1.5G
   CGroup: /system.slice/elasticsearch.service
           ├─ 877 /usr/share/elasticsearch/jdk/bin/java -Xms4m -Xmx64m -XX:+UseSerialGC -Dcli.name=server -Dcli.script=/usr/share/ela>
           ├─1722 /usr/share/elasticsearch/jdk/bin/java -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -D>
           └─1741 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/controller

Dec 08 23:18:29 rocky8.linuxvmimages.local systemd[1]: Starting Elasticsearch...
Dec 08 23:19:08 rocky8.linuxvmimages.local systemd-entrypoint[1722]: CompileCommand: dontinline java/lang/invoke/MethodHandle.setAsTy>
Dec 08 23:19:08 rocky8.linuxvmimages.local systemd-entrypoint[1722]: CompileCommand: dontinline java/lang/invoke/MethodHandle.asTypeU>
Dec 08 23:21:12 rocky8.linuxvmimages.local systemd[1]: Started Elasticsearch.

I am suspecting 2GB ram, and 1 core CPU(virtual machine) isn't enough for elasticsearch. If so, I'm done with Elasticsearch as I don't have a new PC atm.

4

Ok, thanks for the update.
Please execute the curl command against this elastic node to verify if it is returning the response as expected.
The error is clear : ERROR: Failed to determine the health of the cluster.

5

Can you provide the curl command?

curl localhost:9200 -u elastic

Ask for password.

6

Hi @aalaskapedh

Looks like perhaps the JVM is to 4mb to 64mb
Elastic requires at least 512MB, perhaps 1GB

so in the

/etc/elasticsearch/jvm.options.d/jvm.options

Perhaps set

-Xms1g
-Xmx1g

or

-Xms512m
-Xmx512m

Also because of the way you set up your elasticsearch.yml

From the docs here

This command uses an HTTP connection to connect to the cluster and run the user management requests. The command automatically attempts to establish the connection over HTTPS by using the xpack.security.http.ssl settings in the elasticsearch.yml

You have set to authenticate but not SSL on HTTPS or Transport which are the defaults so in order to reset the password you need to give the non HTTPS URL

./bin/elasticsearch-reset-password -u elastic --url http://localhost:9200

1 Like