# Node Left Cluster After enabling X-Pack

**URL:** <https://discuss.elastic.co/t/node-left-cluster-after-enabling-x-pack/323745>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [January 23, 2023, 3:45pm UTC](https://discuss.elastic.co/t/node-left-cluster-after-enabling-x-pack/323745 "2023-01-23T15:45:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![A.Hani](https://avatars.discourse-cdn.com/v4/letter/a/7c8e57/32.png) [@A.Hani](https://discuss.elastic.co/u/A.Hani)\
**Post date:** [January 23, 2023, 3:45pm UTC](https://discuss.elastic.co/t/node-left-cluster-after-enabling-x-pack/323745/1 "2023-01-23T15:45:18Z")

</div>

Hello,  
I have formed a cluster of 2 Nodes, one is master-data and the other is data. Everything was working perfectly until I decided to enable X-Pack minimal security. Below is the config file for both Nodes. Curling the first node after enabling X-Pack is looking pretty good except that it is now not recognizing the other node

"name" : "Elk-1",  
"cluster\_name" : "Cyshield",  
"cluster\_uuid" : "p0M2d0jwR9eRSRPu3cxZNg",  
"version" : {  
"number" : "7.17.8",  
"build\_flavor" : "default",  
"build\_type" : "deb",  
"build\_hash" : "120eabe1c8a0cb2ae87cffc109a5b65d213e9df1",  
"build\_date" : "2022-12-02T17:33:09.727072865Z",  
"build\_snapshot" : false,  
"lucene\_version" : "8.11.1",  
"minimum\_wire\_compatibility\_version" : "6.8.0",  
"minimum\_index\_compatibility\_version" : "6.0.0-beta1"  
},  
"tagline" : "You Know, for Search"  
}

root@ubuntu:/etc/kibana# curl -XGET [http://192.168.120.23:9200/\_cluster/health?pretty](http://192.168.120.23:9200/_cluster/health?pretty) -u elastic  
Enter host password for user 'elastic':  
{  
"cluster\_name" : "Cyshield",  
"status" : "green",  
"timed\_out" : false,  
" **number\_of\_nodes" : 1** ,  
"number\_of\_data\_nodes" : 1,  
"active\_primary\_shards" : 13,  
"active\_shards" : 13,  
"relocating\_shards" : 0,  
"initializing\_shards" : 0,  
"unassigned\_shards" : 0,  
"delayed\_unassigned\_shards" : 0,  
"number\_of\_pending\_tasks" : 0,  
"number\_of\_in\_flight\_fetch" : 0,  
"task\_max\_waiting\_in\_queue\_millis" : 0,  
"active\_shards\_percent\_as\_number" : 100.0  
}  
root@ubuntu:/etc/kibana# dc /etc/elasticsearch/  
dc: Will not attempt to process directory /etc/elasticsearch/  
root@ubuntu:/etc/kibana# cd /etc/elasticsearch/  
root@ubuntu:/etc/elasticsearch# vi elasticsearch  
root@ubuntu:/etc/elasticsearch# vi elasticsearch.yml  
root@ubuntu:/etc/elasticsearch# vi elasticsearch.yml  
root@ubuntu:/etc/elasticsearch# vi elasticsearch.yml

Config File For the first Node

# ======================== Elasticsearch Configuration =========================

# 

# NOTE: Elasticsearch comes with reasonable defaults for most settings.

# Before you set out to tweak and tune the configuration, make sure you

# understand what are you trying to accomplish and the consequences.

# 

# The primary way of configuring a node is via this file. This template lists

# the most important settings you may want to configure for a production cluster.

# 

# Please consult the documentation for further information on configuration options:

# [Elasticsearch Guide | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/index.html)

# 

# ---------------------------------- Cluster -----------------------------------

# 

# Use a descriptive name for your cluster:

# 

cluster.name: Cyshield

# 

# ------------------------------------ Node ------------------------------------

# 

# Use a descriptive name for the node:

# 

node.name: Elk-1

# 

# Add custom attributes to the node:

# 

#node.attr.rack: r1

# 

# ----------------------------------- Paths ------------------------------------

# 

# Path to directory where to store the data (separate multiple locations by comma):

# 

path.data: /var/lib/elasticsearch

# 

# Path to log files:

# 

path.logs: /var/log/elasticsearch

# 

# ----------------------------------- Memory -----------------------------------

# 

# Lock the memory on startup:

**Curling the other Node is returning this error:**

curl -XGET [http://192.168.120.24:9200/\_cluster/health?pretty](http://192.168.120.24:9200/_cluster/health?pretty) -u elastic  
Enter host password for user 'elastic':  
{  
"error" : {  
"root\_cause" : [  
{  
"type" : "security\_exception",  
"reason" : "unable to authenticate user [elastic] for REST request [/\_cluster/health?pretty]",  
"header" : {  
"WWW-Authenticate" : "Basic realm="security" charset="UTF-8""  
}  
}  
],  
"type" : "security\_exception",  
"reason" : "unable to authenticate user [elastic] for REST request [/\_cluster/health?pretty]",  
"header" : {  
"WWW-Authenticate" : "Basic realm="security" charset="UTF-8""  
}  
},  
"status" : 401

**Here's the Config file for the 2nd node:**

# ---------------------------------- Cluster -----------------------------------

# 

# Use a descriptive name for your cluster:

# 

cluster.name: Cyshield

# 

# ------------------------------------ Node ------------------------------------

# 

# Use a descriptive name for the node:

# 

node.name: Elk-2

# 

# Add custom attributes to the node:

# 

#node.attr.rack: r1

# 

# ----------------------------------- Paths ------------------------------------

# 

# Path to directory where to store the data (separate multiple locations by comma):

# 

path.data: /var/lib/elasticsearch

# 

# Path to log files:

# 

path.logs: /var/log/elasticsearch

# 

# ----------------------------------- Memory -----------------------------------

# 

# Lock the memory on startup:# --Network -----------------------------------

# 

# By default Elasticsearch is only accessible on localhost. Set a different

# address here to expose this node on the network:

# 

network.host: 192.168.120.24

# 

# By default Elasticsearch listens for HTTP traffic on the first free port it

# finds starting at 9200. Set a specific HTTP port here:

# 

http.port: 9200

# 

# For more information, consult the network module documentation.

# 

# --------------------------------- Discovery ----------------------------------

# 

# Pass an initial list of hosts to perform discovery when this node is started:

# The default list of hosts is ["127.0.0.1", "[::1]"]

# 

discovery.seed\_hosts: ["192.168.120.23"]

# 

# Bootstrap the cluster using an initial set of master-eligible nodes:

# 

cluster.initial\_master\_nodes: ["Elk-1"]

# 

# For more information, consult the discovery and cluster formation module documentation.

# 

# ---------------------------------- Various -----------------------------------

# 

# Require explicit names when deleting indices:

# 

#action.destructive\_requires\_name: true  
xpack.security.enabled: true  
xpack.security.transport.ssl.enabled: true  
xpack.security.transport.ssl.verification\_mode: certificate

> Blockquote`Preformatted text`

---

<div class="post-metadata">

**Author:** ![Ayush\_Mathur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_mathur/32/77134_2.png) [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\
**Post date:** [January 23, 2023, 4:23pm UTC](https://discuss.elastic.co/t/node-left-cluster-after-enabling-x-pack/323745/2 "2023-01-23T16:23:25Z")

</div>

Can you please post the ES config using \</\> code formatter, it's not really very easy to even read as of now ?

---

<div class="post-metadata">

**Author:** ![A.Hani](https://avatars.discourse-cdn.com/v4/letter/a/7c8e57/32.png) [@A.Hani](https://discuss.elastic.co/u/A.Hani)\
**Post date:** [January 24, 2023, 4:13am UTC](https://discuss.elastic.co/t/node-left-cluster-after-enabling-x-pack/323745/3 "2023-01-24T04:13:41Z")

</div>

Any help would me much appreciated

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2023, 4:13am UTC](https://discuss.elastic.co/t/node-left-cluster-after-enabling-x-pack/323745/4 "2023-02-21T04:13:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.