Unable to create new indices

Hello,

My present scenario is that I am using ELK on a linux machine and it turns out that my trial license has been expired since April 27, 2018 7:19 PM MUT, but I am still able to send logs files/data to my previously created index.

But I realized that now I am unable to send logs file to a new index to be created. My question would be: Is it due to the fact that my trial license has been expired, which is preventing me to create new indices?

Note: No error found in Logstash logs.

Error/warning in Elasticsearch log:

Kind regards,
Ganessen.

Please do not post screenshots of log files. They cannot be searched and are difficult to read on mobile devices.

Just copy-and-paste the text content, and format as a code block (use the </> button, or surround the text with "```" markers).

An expired license does not prevent you from creating new indicies, but it will block some cluster APIs that Logstash may be depending upon.

Hello Tim,

Sorry for this mistake:

Here you go:

        at org.elasticsearch.xpack.monitoring.MonitoringService$MonitoringExecution$1.doRun(MonitoringService.java:221) [x-pack-monitoring-6.2.4.jar:6.2.4]
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.2.4.jar:6.2.4]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_181]
        at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_181]
        at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:573) [elasticsearch-6.2.4.jar:6.2.4]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_181]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_181]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_181]
[2018-08-01T04:08:51,593][ERROR][o.e.x.s.a.f.SecurityActionFilter] [Tod-q-F] blocking [cluster:monitor/stats] operation due to expired license. Cluster health, cluster stats and indices stats
operations are blocked on license expiration. All data operations (read and write) continue to work.
If you have a new license, please update it. Otherwise, please reach out to your support contact.
[2018-08-01T04:08:51,593][ERROR][o.e.x.m.c.c.ClusterStatsCollector] [Tod-q-F] collector [cluster_stats] failed to collect data
org.elasticsearch.ElasticsearchSecurityException: current license is non-compliant for [security]
        at org.elasticsearch.license.LicenseUtils.newComplianceException(LicenseUtils.java:35) ~[?:?]
        at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.apply(SecurityActionFilter.java:96) ~[?:?]
        at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:139) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:81) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.client.node.NodeClient.executeLocally(NodeClient.java:83) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.client.node.NodeClient.doExecute(NodeClient.java:72) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:405) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:394) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.client.support.AbstractClient$ClusterAdmin.execute(AbstractClient.java:706) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.action.ActionRequestBuilder.execute(ActionRequestBuilder.java:46) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.action.ActionRequestBuilder.get(ActionRequestBuilder.java:60) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.xpack.monitoring.collector.cluster.ClusterStatsCollector.lambda$doCollect$0(ClusterStatsCollector.java:106) ~[x-pack-monitoring-6.2.4.jar:6.2.4]
        at org.elasticsearch.xpack.monitoring.collector.cluster.ClusterStatsCollector.doCollect(ClusterStatsCollector.java:110) ~[x-pack-monitoring-6.2.4.jar:6.2.4]
        at org.elasticsearch.xpack.monitoring.collector.Collector.collect(Collector.java:99) [x-pack-monitoring-6.2.4.jar:6.2.4]
        at org.elasticsearch.xpack.monitoring.MonitoringService$MonitoringExecution$1.doRun(MonitoringService.java:221) [x-pack-monitoring-6.2.4.jar:6.2.4]
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.2.4.jar:6.2.4]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_181]
        at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_181]
        at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:573) [elasticsearch-6.2.4.jar:6.2.4]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_181]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_181]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_181]
[2018-08-01T04:09:01,593][ERROR][o.e.x.s.a.f.SecurityActionFilter] [Tod-q-F] blocking [cluster:monitor/stats] operation due to expired license. Cluster health, cluster stats and indices stats
operations are blocked on license expiration. All data operations (read and write) continue to work.
If you have a new license, please update it. Otherwise, please reach out to your support contact.
[2018-08-01T04:09:01,593][ERROR][o.e.x.m.c.c.ClusterStatsCollector] [Tod-q-F] collector [cluster_stats] failed to collect data
org.elasticsearch.ElasticsearchSecurityException: current license is non-compliant for [security]
        at org.elasticsearch.license.LicenseUtils.newComplianceException(LicenseUtils.java:35) ~[?:?]
        at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.apply(SecurityActionFilter.java:96) ~[?:?]
        at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:139) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:81) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.client.node.NodeClient.executeLocally(NodeClient.java:83) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.client.node.NodeClient.doExecute(NodeClient.java:72) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:405) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:394) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.client.support.AbstractClient$ClusterAdmin.execute(AbstractClient.java:706) ~[elasticsearch-6.2.4.jar:6.2.4]
        at org.elasticsearch.action.ActionRequestBuilder.execute(ActionRequestBuilder.java:46) ~[elasticsearch-6.2.4.jar:6.2.4]

get a new license at

An expired license does not prevent you from creating new indicies, but it will block some cluster APIs that Logstash may be depending upon.

Hello Tim,
Is there a way to identify which cluster APIs are being blocked that Logstash depends on.
If that is not the root of problem, how should i proceed to identify why the new index is not being created.
(in my case, logs are not revealing anything).

Thanks in advance.
Ganessen.

Hello Andy,

get a new license at
https://register.elastic.co/xpack_register 2

I did update my expired trial license to a basic one, but still I am unable to create a new index.
Any thoughts about that?

Ganessen.

I think you need to diagnose this a bit more.
Is it that you are unable to create any index? Or is it that logstash cannot create indices? Or ...

I would suggest you start with trying to use the Create Index API via curl and see what happens.

show more log.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.