My setup
I'm using the master branch of docker-elk via Docker for Mac v18.06.0-ce-mac70. The docker-elk repo is currently based on the Elastic stack v6.3.2, and specifically uses the following images (links to GitHub repositories included):
- docker.elastic.co/elasticsearch/elasticsearch-oss:6.3.2
- docker.elastic.co/logstash/logstash-oss:6.3.2
- docker.elastic.co/kibana/kibana-oss:6.3.2
For convenience: link to the docker.elastic.co repository.
Necessity of installing of X-Pack
I'm a bit confused here about whether X-Pack is installed already or not.
The Elastic 'downloads' page for X-Pack clarifies:
In versions 6.3 and later, X-Pack is included with the default distributions of Elastic Stack, with all free features enabled by default.
The 'Installing X-Pack' documentation for ELK 6.3 clarifies:
By default, when you install Elasticsearch, Kibana, and Logstash, X-Pack is installed.
By default, all basic X-Pack features are enabled. You can enable or disable specific X-Pack features in theelasticsearch.yml,kibana.yml, andlogstash.ymlconfiguration files.
Installing X-Pack in Elasticsearch says:
By default, when you install Elasticsearch, X-Pack is installed.
Installing X-Pack in Kibana says:
By default, when you install Kibana, X-Pack is installed.
This all sounds like X-Pack should be installed and set up for me for this version of the Elastic stack, i.e. it is ready-to-use. However, that is not my experience, as I shall detail below.
Inability to use Watcher
The Info API page specifies the following request:
GET /_xpack
For me, invoking that command as-is in the Kibana console (or as a curl: curl -XGET 'http://localhost:9200/_xpack') returns:
{
"error": {
"root_cause": [
{
"type": "invalid_index_name_exception",
"reason": "Invalid index name [_xpack], must not start with _.",
"index_uuid": "_na_",
"index": "_xpack"
}
],
"type": "invalid_index_name_exception",
"reason": "Invalid index name [_xpack], must not start with _.",
"index_uuid": "_na_",
"index": "_xpack"
},
"status": 400
}
The Stats API specifies:
GET _xpack/watcher/stats
And for me, this fires an 'index not found' exception:
{
"error": {
"root_cause": [
{
"type": "index_not_found_exception",
"reason": "no such index",
"resource.type": "index_expression",
"resource.id": "_xpack",
"index_uuid": "_na_",
"index": "_xpack"
}
],
"type": "index_not_found_exception",
"reason": "no such index",
"resource.type": "index_expression",
"resource.id": "_xpack",
"index_uuid": "_na_",
"index": "_xpack"
},
"status": 404
}
I have also come across this command:
GET _watcher/stats?pretty
For me, this returns:
{
"error" : "Incorrect HTTP method for uri [/_watcher/stats?pretty] and method [GET], allowed: [POST]",
"status" : 405
}
I also cannot perform PUTs (please disregard that the 'actions' field is empty for now; the response is the important bit):
PUT _watcher/watch/filebeat-error-alert
{
"trigger" : {
"schedule": "1m"
},
"input": {
"search": {
"request": {
"indices": "filebeat-*",
"body": {
"query": {
"match": {
"level": "error"
}
}
}
}
}
},
"actions": {
}
}
... This returns:
{
"error": {
"root_cause": [
{
"type": "invalid_index_name_exception",
"reason": "Invalid index name [_watcher], must not start with '_', '-', or '+'",
"index_uuid": "_na_",
"index": "_watcher"
}
],
"type": "invalid_index_name_exception",
"reason": "Invalid index name [_watcher], must not start with '_', '-', or '+'",
"index_uuid": "_na_",
"index": "_watcher"
},
"status": 400
}
Of note, my Elastic stack does not start up properly when specifying the key xpack.watcher.enabled (mentioned in the Elasticsearch v6.3 docs) in elasticsearch.yml, giving the error "unknown setting" (much like this post concerning xpack.notification.email for v6.1.1). To clarify, all of the above details I've supplied have been with a successfully started-up Elastic stack, not specifying that key in the elasticsearch.yml file.
Help needed
I would like to get Watcher working to set up my first watch, and X-Pack as well for other features such as notifications. However, I've been unable to make any progress. The documentation suggests that there is no setup required in order for Watcher to work from v6.3.x of the Elastic stack, but that does not match up with my experience. Could you please clarify what I may be missing. Thank you!