Kibana 6.1.1 Authentication Exceptions

We have completed an upgrade procedure from 5.3.1 to 5.6.5 and then 6.1.1 (we have followed your https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-upgrade.html procedure)

Kibana previous versions: 5.3.1
Elasticsearch previous version: 5.3.1 and 5.6.5
Kibana new version: 6.1.1
Elasticsearch new version: 6.1.1

Server OS version:Ubuntu 16.04.2 LTS

Browser version: Chrome-63.0.3239.132 (Build oficial) (64 bits) and Firefox-57.0.4 (64-bit)

Browser OS version: Microsoft Windows Server 2016 Datacenter

Original install method (e.g. download page, yum, from source, etc.): from .tar.gz

Description of the problem including expected versus actual behavior: We have problems Authentication Exceptions which avoiding to use Kibana. Those problems weren't with the 5.3.1 version. It have emerged after upgrading procedure.

Provide logs and/or server output (if relevant):
Jan 12 12:35:41 cerebropci systemd[1]: Stopping Kibana - Your Window into the Elastic Stack...
Jan 12 12:35:41 cerebropci systemd[1]: Stopped Kibana - Your Window into the Elastic Stack.
Jan 12 12:35:41 cerebropci systemd[1]: Started Kibana - Your Window into the Elastic Stack.
Jan 12 12:35:52 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:52Z","tags":["status","plugin:kibana@6.1.1","info"],"pid":12871,"state":"green","message":"Status changed from uninitialized to green - Ready","prevState":"uninitialized","prevMsg":"uninitialized"}
Jan 12 12:35:53 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:53Z","tags":["status","plugin:elasticsearch@6.1.1","info"],"pid":12871,"state":"yellow","message":"Status changed from uninitialized to yellow - Waiting for Elasticsearch","prevState":"uninitialized","prevMsg":"uninitialized"}
Jan 12 12:35:56 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:56Z","tags":["status","plugin:wazuh@3.1.0","info"],"pid":12871,"state":"green","message":"Status changed from uninitialized to green - Ready","prevState":"uninitialized","prevMsg":"uninitialized"}
Jan 12 12:35:56 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:56Z","tags":["status","plugin:console@6.1.1","info"],"pid":12871,"state":"green","message":"Status changed from uninitialized to green - Ready","prevState":"uninitialized","prevMsg":"uninitialized"}
Jan 12 12:35:56 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:56Z","tags":["status","plugin:elasticsearch@6.1.1","info"],"pid":12871,"state":"green","message":"Status changed from yellow to green - Ready","prevState":"yellow","prevMsg":"Waiting for Elasticsearch"}
Jan 12 12:35:56 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:56Z","tags":["\u001b[34mwazuh\u001b[39m","monitoring","info"],"pid":12871,"message":"Creating today index..."}
Jan 12 12:35:56 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:56Z","tags":["\u001b[34mwazuh\u001b[39m","monitoring","info"],"pid":12871,"message":"Skipping index-pattern creation. Already exists."}
Jan 12 12:35:56 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:56Z","tags":["status","plugin:metrics@6.1.1","info"],"pid":12871,"state":"green","message":"Status changed from uninitialized to green - Ready","prevState":"uninitialized","prevMsg":"uninitialized"}
Jan 12 12:35:56 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:56Z","tags":["\u001b[34mwazuh\u001b[39m","monitoring","error"],"pid":12871,"message":"Could not create wazuh-monitoring-3.x-2018.01.12 index on elasticsearch due to [illegal_argument_exception] Rejecting mapping update to [wazuh-monitoring-3.x-2018.01.12] as the final mapping would have more than 1 type: [agent, wazuh] :: {"path":"/wazuh-monitoring-3.x-2018.01.12","query":{},"statusCode":400,"response":"{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Rejecting mapping update to [wazuh-monitoring-3.x-2018.01.12] as the final mapping would have more than 1 type: [agent, wazuh]"}],"type":"illegal_argument_exception","reason":"Rejecting mapping update to [wazuh-monitoring-3.x-2018.01.12] as the final mapping would have more than 1 type: [agent, wazuh]"},"status":400}"}"}
Jan 12 12:35:56 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:56Z","tags":["\u001b[34mwazuh\u001b[39m","initialize","info"],"pid":12871,"message":"Wazuh-version document already exists. Nothing to be done."}
Jan 12 12:35:56 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:56Z","tags":["\u001b[34mwazuh\u001b[39m","initialize","info"],"pid":12871,"message":"No older .wazuh index found -> no need to reindex."}
Jan 12 12:35:57 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:57Z","tags":["status","plugin:timelion@6.1.1","info"],"pid":12871,"state":"green","message":"Status changed from uninitialized to green - Ready","prevState":"uninitialized","prevMsg":"uninitialized"}
Jan 12 12:35:57 cerebropci kibana[12871]: {"type":"log","@timestamp":"2018-01-12T12:35:57Z","tags":["listening","info"],"pid":12871,"message":"Server running at http://0.0.0.0:5601"}

I add the configuration files on both versions:

kibana-6.1.1-linux-x86_64/config/kibana.yml | grep -Ev '^.*#|^$'
server.host: 0.0.0.0
server.basePath: ""
elasticsearch.url: "http://[url]:9200"
elasticsearch.username: "elastic"
elasticsearch.password: "changeme"

kibana-5.3.1-linux-x86_64/config/kibana.yml | grep -Ev '^.*#|^$'
server.host: 0.0.0.0
server.basePath: ""
elasticsearch.url: "http://[url]:9200"
elasticsearch.username: "elastic"
elasticsearch.password: "changeme"

Please, let me know whatever further information you could need.

Thanks and kind regards

X-Pack 6.0+ no longer include default passwords, so you probably need to add a password to elasticsearch and make sure that Kibana has it in the kibana.yml file

Morning Spencer,

thanks for your remark but I must say that we aren't using X-Pack 6.0+ on our Kibana. In fact, we aren't using any default password. The password you can see on the configuration file is false.

Actually, we are using another password. The [url] is false too.

Thanks and kind regards.

Good morning,

Is there any way to debug or troubleshoot this problem?

Thanks and kind regards.

Good morning,

May be my question is not clear enough.

Could I give any further information?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.