Watcher license expired with status code 403

Elastic Stack Elasticsearch
1

Hi,

I get the license expired error when trying to insert a watch. But in the elasticsearch server startup I see the watcher module is loaded. The curl command is executed inside the es-master container. Maybe, I'm not inserting the watcher correctly.

[2019-03-04T14:12:30,550][INFO ][o.e.p.PluginsService ] [es-master-56dcf5b6c7-ptn7g] loaded module [x-pack- watcher ]

{"error":{"root_cause":[{"type":"security_exception","reason":"current license is non-compliant for [watcher]","license.expired.feature":"watcher"}],"type":"security_exception","reason":"current license is non-compliant for [watcher]","license.expired.feature":"watcher"},"status":403}

curl -X PUT "http://localhost:9200/_xpack/watcher/watch/my-watch" -H 'Content-Type: application/json' -d'
{
"trigger" : {
"schedule" : { "cron" : "0 0/1 * * * ?" }
},
"input" : {
"search" : {
"request" : {
"indices" : [
"logstash*"
],
"body" : {
"query" : {
"bool" : {
"must" : {
"match": {
"response": 404
}
},
"filter" : {
"range": {
"@timestamp": {
"from": "{{ctx.trigger.scheduled_time}}||-5m",
"to": "{{ctx.trigger.triggered_time}}"
} } } } } } } } },
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"email_admin" : {
"email" : {
"to" : "admin@domain.host.com",
"subject" : "404 recently encountered"
}}}}'

Thanks.

2

What do you get from the _xpack/license and _xpack/ APIs?

3

curl -X GET "localhost:9200/_xpack/license"
{
"license" : {
"status" : "active",
"uid" : "391a7c72-4bcc-417d-b6cc-69aa2f6d0b41",
"type" : "basic",
"issue_date" : "2019-03-04T14:14:00.416Z",
"issue_date_in_millis" : 1551708840416,
"max_nodes" : 1000,
"issued_to" : "es-cluster",
"issuer" : "elasticsearch",
"start_date_in_millis" : -1
} }

4

You need to call these APIs on your elasticsearch node:

curl  "http://localhost:9200/_xpack/license"

curl  "http://localhost:9200/_xpack/"
5

curl -X GET "localhost:9200/_xpack"

{"build":{"hash":"fe40335","date":"2018-10-30T23:21:04.411928Z"},"license":{"uid":"391a7c72-4bcc-417d-b6cc-69aa2f6d0b41","type":"basic","mode":"basic","status":"active"},"features":{"graph":{"description":"Graph Data Exploration for the Elastic Stack","available":false,"enabled":true},"logstash":{"description":"Logstash management component for X-Pack","available":false,"enabled":true},"ml":{"description":"Machine Learning for the Elastic Stack","available":false,"enabled":true,"native_code_info":{"version":"6.4.3","build_hash":"7a0781676dd492"}},"monitoring":{"description":"Monitoring for the Elastic Stack","available":true,"enabled":false},"rollup":{"description":"Time series pre-aggregation and rollup","available":true,"enabled":true},"security":{"description":"Security for the Elastic Stack","available":false,"enabled":false},"watcher":{"description":"Alerting, Notification and Automation for the Elastic Stack","available":false,"enabled":true}},"tagline":"You know, for X"}

Cannot make sense from the message, available is false but enabled is true.

6

You are running with a basic license.
The subscriptions page shows what features are available on which license type - Watcher requires a paid license of Gold or higher.

It's not available because it's not allowed on this license type.
It's enabled, because it would be automatically enabled if the license was upgraded to a type that allowed its use.

7

Is there a trial license for watcher I can test it out?

Also how do I upgrade from basic to paid license in realtime?

8

https://www.elastic.co/guide/en/elastic-stack-overview/6.4/license-management.html

9

In order to enable the Watcher feature do I need to update the temporary license with acknowledge set to 'true' and type would be set to not 'basic' (maybe use 'trial'). Is that the correct way to enable Watcher as trial when updating the current license? Thanks.

10

At the top of that page:

If you want to try the platinum features, you can start a 30-day trial. Go to the License Management page in Kibana or use the start trial API.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.