Modifying Elasticsearch Basic License

Elastic Stack Elasticsearch
1

I am setting up a forensics virtual training environment where the system date/time is in May 2016. A lot of the basic features are turned off and the Beats agents are not able to communicate. the Elasticsearch basic license status is "invalid" and has an issue_date or 2018-06. Would this date abnormality cause it to malfunction? If so, is there anything I can do to modify the license?

{
"license" : {
"status" : "invalid",
"uid" : "6447d0c7-8b7a-4cf7-ad0a-b56fd9164ba2",
"type" : "basic",
"issue_date" : "2018-06-17T19:03:25.452Z",
"issue_date_in_millis" : 1529262205452,
"max_nodes" : 1000,
"issued_to" : "elasticsearch",
"issuer" : "elasticsearch",
"start_date_in_millis" : -1
}
}

2

Ahh this is an interesting problem. I don't think a license will work in this instance due to the dates.

But what's the actual problem you are seeing? Can you share logs?

3

Wht version of ES are you using?

If it's 6.3 or higher (and it looks like it is), then you can probably solve it by causing the basic license to be generated while the date has been set back to 2016.

If can you rebuild the whole cluster from scratch, then make sure you set the date to 2016 before you start up your first node.

Otherwise, maybe you can fix it by starting a trial license and then reverting back to a basic license.

1 Like
4

I first noticed the problem when I was trying to get two Elasticsearch nodes to recognize each other. While troubleshooting, I was trying to determine if it were a network/firewall issue or a configuration issue. I spun up another VM for Kibana which picked up the primary Elasticsearch node immediately. When I went in to see the cluster information via the Kibana interface it says "permission error: You do not have permission to view or add remote clusters."

Followed by a popup in the bottom right-hand corner saying:
Error refreshing remote clusters
403: Forbidden. You cannot use Remote Clusters because your basic license has expired

I attempted to refresh the license via: curl -uelastic -XPOST 'http://10.21.5.14:9200/_xpack/license/start_basic'. But still have an invalid license as shown in the original problem.

I guess I am unsure what logs to show in this case - I'm somewhat of a novice. I'd be happy to provide whatever you'd like to see.

5

ES Version is 7.0.0. I believe I have tried to regenerate the basic license to no avail. I ran "curl -uelastic -XPOST 'http://10.21.5.14:9200/_xpack/license/start_basic'" with seemingly no effect on the license.

I've tried to rebuild several times, and the license date seems to remain the same. I assumed that it was the earliest date that this version could be valid for. Is there any way I can delete the existing license?

I will try to start a trial license and then revert.

6

Thanks TimV. Your idea worked. I was able to delete the license and regenerate it with the current system time. Working fine now.

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.