# Unable to retrieve license information from license server

**URL:** <https://discuss.elastic.co/t/unable-to-retrieve-license-information-from-license-server/304766>\
**Category:** Logstash\
**Created:** [May 15, 2022, 10:55pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-license-information-from-license-server/304766 "2022-05-15T22:55:25Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmgeurts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmgeurts/32/95115_2.png) [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\
**Post date:** [May 15, 2022, 10:55pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-license-information-from-license-server/304766/1 "2022-05-15T22:55:25Z")

</div>

Setting up a multi-node ELK 8.2 stack and hitting an issue I've not been able to sort out. The basics of Elasticsearch and Kibana are working, but Logstash doesn't want to connect to the one Elasticsearch machine I have. There are three nodes on the same network: Elasticsearch, Kibana and Logstash.

```auto
May 16 00:31:56 ls1.domain.com logstash[343480]: [2022-05-16T00:31:56,482][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"Got response code '401' contacting Elasticsearch at URL 'https://10.1.1.1:9200/_xpack'"}
May 16 00:31:56 ls1.domain.com logstash[343480]: [2022-05-16T00:31:56,501][ERROR][logstash.monitoring.internalpipelinesource] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.

```

However, if I test using curl from the same machine it works fine:

```auto
me@ls1:~$ curl -k -X GET -H "Authorization: ApiKey $API_KEY" "https://10.1.1.1:9200/_xpack"
{"build":{"hash":" ********","date":"2022-04-20T10:35:10.180408517Z"},"license":{"uid":"******","type":"basic","mode":"basic","status":"active"}
,"features":{"aggregate_metric":{"available":true,"enabled":true},"analytics":{"available":true,"enabled":true},"ccr":{"available":false,"enabled":true},"data_streams":{"available":true,"enabled":true},"da
ta_tiers":{"available":true,"enabled":true},"enrich":{"available":true,"enabled":true},"eql":{"available":true,"enabled":true},"frozen_indices":{"available":true,"enabled":true},"graph":{"available":false,
"enabled":true},"ilm":{"available":true,"enabled":true},"logstash":{"available":false,"enabled":true},"ml":{"available":false,"enabled":true},"monitoring":{"available":true,"enabled":true},"rollup":{"avail
able":true,"enabled":true},"searchable_snapshots":{"available":false,"enabled":true},"security":{"available":true,"enabled":true},"slm":{"available":true,"enabled":true},"spatial":{"available":true,"enable
d":true},"sql":{"available":true,"enabled":true},"transform":{"available":true,"enabled":true},"voting_only":{"available":true,"enabled":true},"watcher":{"available":false,"enabled":true}},"tagline":"You k
now, for X"}

```

So I guess this rules out the api\_key in use, connectivity and the configuration of Elasticsearch. I've disabled all config under /etc/logstash/conf.d, I'm just trying to get logstash monitoring working. logstash.yml is default apart for:

```auto
node.name ls1
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.hosts: ["https://10.1.1.1:9200"]
xpack.monitoring.elasticsearch.api_key: " ****** =="
xpack.monitoring.elasticsearch.ssl.certificate_authority: "/etc/logstash/certs/http_ca.crt"

```

What am I missing? Most other articles use basic auth, or struggle with SSL. There are no errors in the Elasticsearch logs.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 15, 2022, 11:41pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-license-information-from-license-server/304766/2 "2022-05-15T23:41:25Z")

</div>

Hi @dmgeurts Welcome to the community.

Can you provide your actual logstash pipeline config so we can see, especially the `output` section?

Are there any other logs during the connection about failing to connect, "can not establish connection..." etc

Also trying to debug through the legacy monitoring settings in your logstash.yml is probably not as helpful can you just comment that all out for the time being.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 16, 2022, 10:54am UTC](https://discuss.elastic.co/t/unable-to-retrieve-license-information-from-license-server/304766/3 "2022-05-16T10:54:26Z")

</div>

> [@dmgeurts](#):
>
> `node.name ls1`

Is this a single or multiple node cluster?

---

<div class="post-metadata">

**Author:** ![dmgeurts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmgeurts/32/95115_2.png) [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\
**Post date:** [June 3, 2022, 4:18pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-license-information-from-license-server/304766/4 "2022-06-03T16:18:21Z")

</div>

Sorry for the slow response. I don't think I have a pipeline yet, I thought I'd get the monitoring of logstash working first. Your suggestion appears to be to ignore logging for now and just focus on the writer pipe from logstash into Elasticsearch?

One error I found was that I didn't list the only the \<api\_key\>. Once I set the right string as :\<api\_key\> I now get `Authentication using apikey failed - invalid credentials` in the Elasticsearch logs. However I created the api\_key with:

```auto
POST /_security/api_key
{
  "name": "logstash_els00", 
  "role_descriptors": {
    "logstash_monitoring": { 
      "cluster": ["monitor"],
      "index": [
        {
          "names": [".monitoring-ls-*"],
          "privileges": ["create_index", "create"]
        }
      ]
    }
  }
}

```

As per: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html

---

<div class="post-metadata">

**Author:** ![dmgeurts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmgeurts/32/95115_2.png) [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\
**Post date:** [June 3, 2022, 4:18pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-license-information-from-license-server/304766/5 "2022-06-03T16:18:45Z")

</div>

Multinode

---

<div class="post-metadata">

**Author:** ![dmgeurts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmgeurts/32/95115_2.png) [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\
**Post date:** [June 20, 2022, 2:13pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-license-information-from-license-server/304766/6 "2022-06-20T14:13:18Z")

</div>

So, time to fess up... I made two simple but big mistakes with the api\_key:

1. I failed to include the `"id"`
2. I used the encoded value rather than the `"api_key"`

In hindsight, I'm proper kicking myself for not seeing this earlier. But I'm there now with working api\_keys. So the format to use in config files is `"<id>:<api_key>"`. Don't use the `"encoded"` string as I did, and don't forget to add the ID either...!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2022, 2:13pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-license-information-from-license-server/304766/7 "2022-07-18T14:13:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.