Update ELK-Stack with new security features in docker

[J143]

Hello, I want to setup the ELK-Stack with docker-compose. The version 6.7 works fine. But now I want to add the new free elasticsearch security features (only create users and roles, no ssl certificate). Does anybody know, what I have to set in the kibana.yml and the elasticsearch.yml. Or is something more to do?

[TimV (Tim Vernum)]

Hi @J143

If you simply want to turn on authentication, and configure users + roles, then you need 3 changes:

elasticssearch.yml

xpack.security.enabled: true

kibana.yml

elasticsearch.username: "kibana"
elasticsearch.password: "password-for-the-kibana-user"

There's more info about setting up security here, which will explain how to generate the password for the "kibana" user.

• https://www.elastic.co/blog/getting-started-with-elasticsearch-security
• https://www.elastic.co/guide/en/elasticsearch/reference/7.1/configuring-security.html

For docker, if you are using the Elastic supplied images then there are a few different options about how you can add these settings to your config.
The docs for docker config are here:

• https://www.elastic.co/guide/en/elasticsearch/reference/7.1/docker.html#docker-configuration-methods

[TimV (Tim Vernum)]

However (I forgot to mention this in my previous reply), if you have multiple ES nodes in your cluster, and you wish to enable security you must also enable TLS (SSL) on the "transport" interface (the way that ES nodes talk to each other).

[J143]

I get the following Error, if I start docker-compose up:

elasticsearch_1 | "stacktrace": ["org.elasticsearch.indices.recovery.RecoveryFailedException: [filebeat-2019.05.06][4]: Recovery failed on {cc940370fc8e}{6jI-woElQ0KY54dDhqQKLg}{V5hU_7KLTw6t27HFQoD4Xg}{}{:9300}{ml.machine_memory=8364879872, xpack.installed=true, ml.max_open_jobs=20}"

where is the elasticsearch ip

[J143]

I tried to update from 6.7.1 to 7.1.0