Unusual auth error after moving to Elastic stack v6.4.2

[nick-george]

Hi,

I've just updated to v6.4.2 of Elasticsearch + Kibana. (RPM on RHEL7)

I'm encountering some auth errors when starting Kibana. I am using Searchguard (no issues prior to v6.4.2), and normally if there are any issues with it, I would see logs in elasticsearch.log (in which I'm seeing no errors).

When I start Kibana, I see the following in the kibana.log:

{"type":"log","@timestamp":"2018-10-21T01:16:32Z","tags": ["status","plugin:elasticsearch@6.4.2","error"],"pid":4973,"state":"red","message":"Status changed from yellow to red - Authentication Exception","prevState":"yellow","prevMsg":"Waiting for Elasticsearch"}
{"type":"log","@timestamp":"2018-10-21T01:16:32Z","tags":["warning"],"pid":4973,"message":"Detected an unhandled Promise rejection.\nAuthentication Exception :: {\"path\":\"/myindex/_search\",\"query\": 
{\"q\":\"type=acl\",\"size\":100},\"statusCode\":401,\"response\":\"Unauthorized\",\
"wwwAuthenticateDirective\":\"Basic realm=\\\"Search Guard\\\"\"}"}

I'd like to be able to completely disable or remove x-pack, but this doesn't appear possible. As an alternative, I've disabled xpack security in the elasticsearch.yml, but that doesn't appear to have helped.

Any ideas?

Many thanks,
Nick George

[nick-george]

A quick update.

I just tried the elasticsearch-oss package in order to completely take x-pack out of the equation, but am getting the same error. Will keep looking.

[spalger (Spencer Alger)]

You can also use the kibana-oss package which does not include X-Pack. Hope that helps!

[nick-george]

Thanks for your message Spencer.

I managed to fix the issue. Was purely due to my own misconfiguration of Kibana. Please disregard.

I was dropping Kibana's credentials from kibana.yml. Doh!