Recently added basic license, can’t access Kibana

[MatthewHartz]

Reposting topic from Recently added basic license, can't access Kibana.

Hi,

Today I added a basic license because my trial shield expired. I can successfully access elasticsearch without having to enter in credentials, but still receive a login screen for Kibana. This login screen will not allow me to pass even with the "correct" credentials.

Any ideas?

Thanks!

[jkuang (Jimmy Kuang)]

You are seeing the warning message because you formally had Shield setup. The basic license does not include Shield as stated in the link below:

https://www.elastic.co/subscriptions

So the Shield authentication feature is preventing you from logging in. You can try disabling Shield and start up Kibana.

You can configure the following in the elasticsearch.yml file:
shield.enabled: false

[skearns (Steve Kearns)]

Hi, it looks like you may have hit an issue we had with versions of Kibana XPack/Shield prior to 5.0.1, where Kibana security doesn't recognize the basic license and properly disable itself.

From the screenshot, it looks like you're using Kibana 4.x, so you will need to either uninstall the Shield plugin from Kibana, or I believe you can manually disable the Shield plugin by putting shield.enabled: false in your kibana.yml. On mobile so I can't confirm the Kibana.yml setting.

[MatthewHartz]

Hi @skearns,

So I discovered that if i go into each node of elasticsearch, and set "marvel.agent.enabled: false" and restart each service it works.

This is incredibly tedious, especially if we have a lot of nodes and environments. Is there a cluster settings API i can hit to do this instead? Or an example powershell/bash scripts I can run from Windows? Unfortunately i'm a super novice in regards to Linux.

Thanks

[skearns (Steve Kearns)]

Hi Matthew,

Are you saying that by disabling Marvel on every ES node and restarting the node, the Kibana UI stops asking for a password? That doesn't sound quite right to me... Hm. If that did work for you, it's likely that it doesn't have anything to do with disabling Marvel, and is due to the fact that Kibana had to re-establish a connection to ES after you shut down the ES node that Kibana was pointing at.

In general, in 2.x, if you apply a Basic license, you should remove the Shield plugin from Kibana, and the login screen should go away. In 5.0.1 and above, this is now seamless - you just apply the Basic license, and Security/watcher/graph/reporting are all properly disabled in both ES and Kibana, as described here.

Glad you're back up and running, though note that by disabling the marvel agent in ES, you won't be collecting any monitoring data from the nodes of your cluster.

Thanks,
Steve

[MatthewHartz]

Hi @skearns
Thanks for all the replies. Yeah, i'm not really sure. I tried following the basic instructions for removing marvel at https://www.elastic.co/guide/en/marvel/2.3/installing-marvel.html#uninstalling-marvel and I actually get Kibana to go hay-wire where I can't seem to kill the process to actually restart /facepalm.

I'm currently using what Azure & elasticsearch offers in regards to cluster installations for 2.4.0. But I notice azure now supports 5.1.2, would there be any code migration issues if I just deployed 5.1.2? This seems like it would be the simplest solution. If i recall 2.x -> 5.x is pretty minimal...

Thanks!

[MatthewHartz]

Hi @skearns,

I figured it out how to disassociate from marvel following one of your previous responses. I appreciate the help, i'll detail how i restarted kibana after updating the config file in case anyone is banging their heads on their keyboard like I was at one point.

Thanks!

cd ../../opt/kibana
ps -ef | grep kibana
sudo kill {list of processes}
sudo bin/kibana serve restart
ctrl + c
wait about 30 seconds