License issue!

Hi All,

I have removed X-pack from my ELK stack still i am not able to start elasticsearch nodes getting LIC related exception .

Also all setting related to X-pack are disabled .

[2018-04-02T14:22:19,509][INFO ][o.e.g.GatewayService ] [ES-Node-01] recovered [130] indice
s into cluster_state
[2018-04-02T14:22:23,304][ERROR][o.e.x.s.a.f.SecurityActionFilter] [SBIT-ES-01] blocking [clust
er:monitor/stats] operation due to expired license. Cluster health, cluster stats and indices stats
operations are blocked on license expiration. All data operations (read and write) continue to work.
If you have a new license, please update it. Otherwise, please reach out to your support contact.
[2018-04-02T14:22:23,307][ERROR][o.e.x.m.c.c.ClusterStatsCollector] [SBIT-ES-01] collector [clu
ster_stats] failed to collect data
org.elasticsearch.ElasticsearchSecurityException: current license is non-compliant for [security]
at org.elasticsearch.license.LicenseUtils.newComplianceException( ~[?:?]
va:96) ~[?:?]
165) ~[elasticsearch-6.1.1.jar:6.1.1]
at ~[elasticsearc
at ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.client.node.NodeClient.executeLocally( ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.client.node.NodeClient.doExecute( ~[elasticsearch-6.1.1.jar:6.1.1]
at ~[elasticsearch-6.1.1.jar:6.1.1]
at ~[elasticsearch-6.1.1.jar:6.1.1]
at$ClusterAdmin.execute( ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.action.ActionRequestBuilder.execute( ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.action.ActionRequestBuilder.get( ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.xpack.monitoring.collector.cluster.ClusterStatsCollector.lambda$doCollect$0( ~[x-pack-6.1.1.jar:6.1.1]
at org.elasticsearch.xpack.monitoring.collector.cluster.ClusterStatsCollector.doCollect( ~[x-pack-6.1.1.jar:6.1.1]
at org.elasticsearch.xpack.monitoring.collector.Collector.collect( [x-pack-6.1.1.jar:6.1.1]
at org.elasticsearch.xpack.monitoring.MonitoringService$MonitoringExecution$1.doRun( [x-pack-6.1.1.jar:6.1.1]
at [elasticsearch-6.1.1.jar:6.1.1]
at java.util.concurrent.Executors$ [?:1.8.0_161]
at [?:1.8.0_161]
at org.elasticsearch.common.util.concurrent.ThreadContext$ [elasticsearch-6.1.1.jar:6.1.1]
at java.util.concurrent.ThreadPoolExecutor.runWorker( [?:1.8.0_161]
at java.util.concurrent.ThreadPoolExecutor$ [?:1.8.0_161]
at [?:1.8.0_161]
[2018-04-02T14:22:26,398][INFO ][o.e.c.r.a.AllocationService] [SBIT-ES-01] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[.monitoring-es-6-2018.02.03][0], [.monitoring-es

i dont want to use X-pack just ELK stack .
how to resolve above issue ?

You can uninstall xpack or better ask for a free basic license which includes some cool features like more zoom in Kibana, monitoring, profile UI, LS pipelines monitoring...

The fact that you are getting that exception is evidence that you have not actually removed X-Pack.


This is a piece of code from inside X-Pack, if it were removed then the message would not exist any more.

What steps did you take when you tried to remove X-Pack?

Though as @dadoonet suggests, we would recommend that you simply install a free basic license instead of removing x-pack all together.

Hi Tim and Dadoonet ,

I have uninstalled X-pack from all nodes like below ,

Component remove x-pack,

bin]# ./elasticsearch-plugin remove x-pack
-> removing [x-pack]...
-> preserving plugin config files [/etc/elasticsearch/x-pack] in case of upgrade; use --purge if not needed

for installing basic lic , actually , i just want to run My ELK Stack without X-pack .

so please help how to resolve above error ?
or "o.e.x.s.a.f.SecurityActionFilter" where to remove this ?

Did you restart Elasticsearch after you removed x-pack?

Would you be willing to explain why you want to do that?
Starting in Elasticsearch 6.3, we intend to ship X-Pack installed by default, so I'm interested in hearing about why you want to remove it.

1 Like

yes i did restart after removing X-pack .
so i got above exception.

Reason for removing X-pack is to use other security solution .
i am using ELK ver 6.1 .

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.