Kibana web page Authentication Exception

Hi all,
I'm new to ELK and I'm using filebeat to harvest log data and send them to elasticsearch and use kibana to show data. And I use search guard to enable HTTPS and basic auth for elasticsearch.
After configing https and basic auth for es, i start up kibana and it started well

[root@localhost kibana]# ./bin/kibana

log [02:15:11.929] [info][status][plugin:kibana@6.2.4] Status changed from uninitialized to green - Ready
log [02:15:12.201] [info][status][plugin:elasticsearch@6.2.4] Status changed from uninitialized to yellow - Waiting for Elasticsearch
log [02:15:12.611] [info][status][plugin:timelion@6.2.4] Status changed from uninitialized to green - Ready
log [02:15:12.639] [info][status][plugin:console@6.2.4] Status changed from uninitialized to green - Ready
log [02:15:12.657] [info][status][plugin:metrics@6.2.4] Status changed from uninitialized to green - Ready
log [02:15:12.740] [info][listening] Server running at http://x.x.x.x:5601
log [02:15:12.816] [info][status][plugin:elasticsearch@6.2.4] Status changed from yellow to green - Ready

but when i login to the kibana web page and click the Discover button it shows that Authentication Exception whit a response {"statusCode":401,"error":"Unauthorized","message":"Authentication Exception"}

Error: Authentication Exception
at http://172.22.6.25:5601/bundles/commons.bundle.js?v=16627:1:688862
at processQueue (http://172.22.6.25:5601/bundles/vendors.bundle.js?v=16627:58:132456)
at http://172.22.6.25:5601/bundles/vendors.bundle.js?v=16627:58:133349
at Scope.$digest (http://172.22.6.25:5601/bundles/vendors.bundle.js?v=16627:58:144239)
at Scope.$apply (http://172.22.6.25:5601/bundles/vendors.bundle.js?v=16627:58:147018)
at done (http://172.22.6.25:5601/bundles/vendors.bundle.js?v=16627:58:100026)
at completeRequest (http://172.22.6.25:5601/bundles/vendors.bundle.js?v=16627:58:104697)
at XMLHttpRequest.xhr.onload (http://172.22.6.25:5601/bundles/vendors.bundle.js?v=16627:58:105435)

Can anyone please give me some help , thanks all.

After some attempt, i have figured out that wrong username or password in the filebeat.yml is the reason for "Authentication Exception" in the kibana web page. Since i changed the default password for admin user of es, but i did not run the sgadmin.sh to bring it into effect and then i changed the es password in the filebeat.yml.
The filebeat log shows that

Failed to connect: 401 Unauthorized: Unauthorized

And the es log shows thar

Authentication finally failed for admin

It's a really self mistake, sorry for that.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.