Hi All,
I want to do a POC and try out some of the features of remote ingestion, ML & SIEM before we buy and implement ECE in prod. its been few days I am trying to get this issue resolved but I am unable to resolve completely hence thought to approach the experts in this forum as I am using a trial version.
Installed the trial version of ECE 2.5 in my private cloud successfully. I do not have a DNS, SSL certs and haproxy (for LB) in place. I am using default SSL certs that came up with ece build. All my allocators are in same subnet
Q1 - I guess still I should be able to access the kibana portal using <IP address>:9243?
Q2 - No additional steps needed for using default certs to use https i.e. 9243?
My cluster is having 3 allocator nodes. My first cluster I plan to have is 3 (Masters, Kibana & Data nodes) for HA purpose hosted on the said allocators. I have made the hostname & IP address entries in /etc/hosts file
I can access Admin UI on 12400 port without any problem but I cant access kibana on 9243 using IP address. Below are my findings and request for help as the license is valid for limited period only
[elastic@ecehost1 ~]$ curl -k -u elastic https://192.168.1.1:9243
Enter host password for user 'elastic':
{"ok":false,"message":"Unknown deployment."}
[elastic@ecehost1 ~]$ curl -u elastic https://192.168.1.1:9243
Enter host password for user 'elastic':
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
[elastic@ecehost1 ~]$
[elastic@ecehost1 ~]$ curl -k -u elastic https://72bbc3de0e144f378ebab582fe3ea047.192.168.1.1:9243/_health
Enter host password for user 'elastic':
{
"ok": true,
"status": 200
}
[elastic@ecehost1 ~]$
--------------------------- health status log output below ----------------------------------
{"type":"response","@timestamp":"2020-08-10T16:29:13Z","tags":["api"],"pid":32,"method":"get","statusCode":200,"req":{"url":"/api/status","method":"get","headers":{"host":"192.168.1.1:18350","user-agent":"Go-http-client/1.1","accept-encoding":"gzip"},"remoteAddress":"172.17.42.1","userAgent":"172.17.42.1"},"res":{"statusCode":200,"responseTime":42,"contentLength":9},"message":"GET /api/status 200 42ms - 9.0B"}
----------------- trying to hit non existing page --------------
[elastic@ecehost1 ~]$ curl -k -u elastic https://72bbc3de0e144f378ebab582fe3ea047.192.168.1.1:9243/apps
Enter host password for user 'elastic':
{"statusCode":404,"error":"Not Found","message":"Not Found"}
[elastic@ecehost1 ~]$
----------------------- error log below for 404 error ---------------
{"type":"response","@timestamp":"2020-08-10T16:30:38Z","tags":[],"pid":32,"method":"get","statusCode":404,"req":{"url":"/apps","method":"get","headers":{"host":"192.168.1.1:18350","user-agent":"curl/7.29.0","accept":"*/*","x-cloud-request-id":"vSsroRS-SMGkcI-R8dJ9jw","x-forwarded-host":"72bbc3de0e144f378ebab582fe3ea047.192.168.1.1:9243","x-found-kibana-cluster":"72bbc3de0e144f378ebab582fe3ea047"},"remoteAddress":"172.17.42.1","userAgent":"172.17.42.1"},"res":{"statusCode":404,"responseTime":300,"contentLength":9},"message":"GET /apps 404 300ms - 9.0B"}