License issue!

Elastic Stack Elasticsearch
1

Hi All,

I have removed X-pack from my ELK stack still i am not able to start elasticsearch nodes getting LIC related exception .

Also all setting related to X-pack are disabled .

[2018-04-02T14:22:19,509][INFO ][o.e.g.GatewayService ] [ES-Node-01] recovered [130] indice
s into cluster_state
[2018-04-02T14:22:23,304][ERROR][o.e.x.s.a.f.SecurityActionFilter] [SBIT-ES-01] blocking [clust
er:monitor/stats] operation due to expired license. Cluster health, cluster stats and indices stats
operations are blocked on license expiration. All data operations (read and write) continue to work.
If you have a new license, please update it. Otherwise, please reach out to your support contact.
[2018-04-02T14:22:23,307][ERROR][o.e.x.m.c.c.ClusterStatsCollector] [SBIT-ES-01] collector [clu
ster_stats] failed to collect data
org.elasticsearch.ElasticsearchSecurityException: current license is non-compliant for [security]
at org.elasticsearch.license.LicenseUtils.newComplianceException(LicenseUtils.java:35) ~[?:?]
at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.apply(SecurityActionFilter.ja
va:96) ~[?:?]
at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:
165) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:139) ~[elasticsearc
h-6.1.1.jar:6.1.1]
at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:81) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.client.node.NodeClient.executeLocally(NodeClient.java:83) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.client.node.NodeClient.doExecute(NodeClient.java:72) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:405) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:394) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.client.support.AbstractClient$ClusterAdmin.execute(AbstractClient.java:706) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.action.ActionRequestBuilder.execute(ActionRequestBuilder.java:46) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.action.ActionRequestBuilder.get(ActionRequestBuilder.java:60) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.xpack.monitoring.collector.cluster.ClusterStatsCollector.lambda$doCollect$0(ClusterStatsCollector.java:106) ~[x-pack-6.1.1.jar:6.1.1]
at org.elasticsearch.xpack.monitoring.collector.cluster.ClusterStatsCollector.doCollect(ClusterStatsCollector.java:110) ~[x-pack-6.1.1.jar:6.1.1]
at org.elasticsearch.xpack.monitoring.collector.Collector.collect(Collector.java:100) [x-pack-6.1.1.jar:6.1.1]
at org.elasticsearch.xpack.monitoring.MonitoringService$MonitoringExecution$1.doRun(MonitoringService.java:222) [x-pack-6.1.1.jar:6.1.1]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.1.1.jar:6.1.1]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_161]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_161]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:568) [elasticsearch-6.1.1.jar:6.1.1]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_161]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_161]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]
[2018-04-02T14:22:26,398][INFO ][o.e.c.r.a.AllocationService] [SBIT-ES-01] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[.monitoring-es-6-2018.02.03][0], [.monitoring-es

i dont want to use X-pack just ELK stack .
how to resolve above issue ?

2

You can uninstall xpack or better ask for a free basic license which includes some cool features like more zoom in Kibana, monitoring, profile UI, LS pipelines monitoring...

3

The fact that you are getting that exception is evidence that you have not actually removed X-Pack.

o.e.x.s.a.f.SecurityActionFilter

This is a piece of code from inside X-Pack, if it were removed then the message would not exist any more.

What steps did you take when you tried to remove X-Pack?

Though as @dadoonet suggests, we would recommend that you simply install a free basic license instead of removing x-pack all together.

4

Hi Tim and Dadoonet ,

I have uninstalled X-pack from all nodes like below ,

Component remove x-pack,

bin]# ./elasticsearch-plugin remove x-pack
-> removing [x-pack]...
-> preserving plugin config files [/etc/elasticsearch/x-pack] in case of upgrade; use --purge if not needed

for installing basic lic , actually , i just want to run My ELK Stack without X-pack .

so please help how to resolve above error ?
or "o.e.x.s.a.f.SecurityActionFilter" where to remove this ?

5

Did you restart Elasticsearch after you removed x-pack?

Would you be willing to explain why you want to do that?
Starting in Elasticsearch 6.3, we intend to ship X-Pack installed by default, so I'm interested in hearing about why you want to remove it.

1 Like
6

yes i did restart after removing X-pack .
so i got above exception.

Reason for removing X-pack is to use other security solution .
i am using ELK ver 6.1 .

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.