# X-pack questions on installation **URL:** \ **Category:** Elasticsearch\ **Created:** [April 27, 2018, 3:00pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849 "2018-04-27T15:00:18Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [April 27, 2018, 3:00pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/1 "2018-04-27T15:00:19Z")
Greetings - I have just installed x-pack 6.2.4 with ELK versions 6.2.4. I created the user passwords for elastic, kibana, and logstash-system. Kibana is running and I'm able to login - however I am not receiving any new index data. I've confirmed that my default index is \* and have even refreshed the fields. One guess I have is that i had to create the elastic user before I installed x-pack - meaning that the elastic users was NOT used to create and install the entire ELK stack. Are there permissions issues here? The elastic user is a super user so i would guess not? I am running on the supplied trial license which should enable all functionality correct? ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [April 27, 2018, 3:17pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/2 "2018-04-27T15:17:59Z")
so this may be telling: root@oc-elk:~# curl -k -u elastic 'http://\:9200/\_xpack/security/\_authenticate?pretty' Enter host password for user 'elastic': curl: (6) Could not resolve host: \ ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 27, 2018, 3:31pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/3 "2018-04-27T15:31:18Z")
Hello, > \ You are supposed to replace `` with the IP Address or the FQDN of the host where Elasticsearch runs. > however I am not receiving any new index data What exactly do you mean by this ? How are you trying to ingest data into Elasticsearch ? You can try and follow [this example](https://www.elastic.co/guide/en/kibana/current/getting-started.html) in order to load some data into an index and visualize it in Kibana ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [April 27, 2018, 3:35pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/4 "2018-04-27T15:35:25Z")
thanks for the quick reply - duh on the server IP: root@oc-elk:/etc/kibana# curl -k -u elastic '[http://10.7.1.61:9200/\_xpack/security/\_authenticate?pretty](http://10.7.1.61:9200/_xpack/security/_authenticate?pretty)' Enter host password for user 'elastic': { "username" : "elastic", "roles" : [ "superuser" ], "full\_name" : null, "email" : null, "metadata" : { "\_reserved" : true }, "enabled" : true } I am using logstash + filebeat, winlogbeat, metricbeat ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [April 27, 2018, 3:38pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/5 "2018-04-27T15:38:06Z")
so im guessing according to this: [https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html](https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html) I'll need to add usernames/passwords to each product .yml file to get started? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 27, 2018, 3:44pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/6 "2018-04-27T15:44:04Z")
Yes, each product that connects to Elasticsearch needs to have x-pack installed and you need to configure the necessary credentials so that it can authenticate to Elasticsearch. ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [April 27, 2018, 4:11pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/7 "2018-04-27T16:11:28Z")
Ioannis thank you. I'm configuring each product now - does elasticsearch need a username and password itself configured in the elasticsearch.yml? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 27, 2018, 4:18pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/8 "2018-04-27T16:18:47Z")
No, it doesn't. Go through our documentation in the link you posted, it should get you up and running in no time. Then also go through [this section](https://www.elastic.co/guide/en/x-pack/current/xpack-security.html) that will talk about setting up TLS for the http and transport layer so that you can have integrity and confidentiality in the communications between the components of the elastic stack ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [April 27, 2018, 4:22pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/9 "2018-04-27T16:22:39Z")
Thanks again - this is a single-node install ....for now. I would guess the TLS portion would not apply. I will review the docs again and follow up later! ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [April 27, 2018, 6:37pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/10 "2018-04-27T18:37:28Z")
I believe I have included the correct usernames and passwords however it seems that im still not getting index data to load. Here are the 3 configs without commented lines: root@oc-elk:/etc/elasticsearch# cat elasticsearch.yml | grep -v "#" cluster.name: ocs-elk-cluster node.name: oc-elk path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch network.host: 10.7.1.61 root@oc-elk:/etc/logstash# cat logstash.yml | grep -v "#" path.data: /var/lib/logstash path.logs: /var/log/logstash xpack.monitoring.elasticsearch.username: logstash\_system xpack.monitoring.elasticsearch.password: xxxxxx root@oc-elk:/etc/kibana# cat kibana.yml | grep -v "#" server.host: "10.7.1.61" server.name: "oc-elk" elasticsearch.url: "[http://10.7.1.61:9200](http://10.7.1.61:9200)" elasticsearch.username: "kibana" elasticsearch.password: "xxxxx" I think it's interesting that the logstash info does not have quotes but that is per the documentation. ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [April 27, 2018, 7:28pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/11 "2018-04-27T19:28:11Z")
also interesting that upon remove of x-pack it seems the "plugin" is not installed in logstash: root@oc-elk:~# service elasticsearch stop root@oc-elk:~# cd /usr/share/elasticsearch/ root@oc-elk:/usr/share/elasticsearch# bin/elasticsearch-plugin remove x-pack -\> removing [x-pack]... -\> preserving plugin config files [/etc/elasticsearch/x-pack] in case of upgrade; use --purge if not needed root@oc-elk:/usr/share/elasticsearch# service elasticsearch restart root@oc-elk:/usr/share/elasticsearch# cd ../kibana/ root@oc-elk:/usr/share/kibana# bin/kibana-plugin remove x-pack Removing x-pack... root@oc-elk:/usr/share/kibana# service kibana restart root@oc-elk:/usr/share/kibana# cd ../logstash/ root@oc-elk:/usr/share/logstash# bin/logstash-plugin remove x-pack ERROR: Operation aborted, cannot remove plugin., message: This plugin has not been previously installed root@oc-elk:/usr/share/logstash# service logstash restart ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 29, 2018, 5:08pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/12 "2018-04-29T17:08:35Z")
> [@irb7501](#): > > I think it's interesting that the logstash info does not have quotes but that is per the documentation. Quotes in YAML are optional when the string value doesn't contain any special characters. > [@irb7501](#): > > root@oc-elk:/usr/share/logstash# bin/logstash-plugin remove x-pack > > ERROR: Operation aborted, cannot remove plugin., message: This plugin has not been previously installed It looks like you haven't installed x-pack for logstash ( You need to install X-Pack for Elasticsearch, Kibana and Logstash ). Please reinstall X-Pack in elasticsearch and then also run ```auto bin/logstash-plugin install x-pack ``` ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 2, 2018, 6:11pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/13 "2018-05-02T18:11:23Z")
i think there are a few things wrong here - first my elasticsearch and java was installed as root. I've been unable to get x-pack running at all. I've removed x-pack entirely and will try again. I've added the user elastic to sudo and am trying the x-pack install now. installing the machine learning engine is resulting in this: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: plugin forks a native controller @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ This plugin launches a native controller that is not subject to the Java security manager nor to system call filters. Continue with installation? [y/N]y Exception in thread "main" java.nio.file.FileSystemException: /etc/elasticsearch/x-pack/roles.yml: Operation not permitted ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 2, 2018, 7:09pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/14 "2018-05-02T19:09:38Z")
Hi again, Let's take it from the beginning: - How did you install Elasticsearch? - Since you are using linux, is there any reason why you are not using our `.deb` or `.rpm` packages? See [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html) and [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html). > [@irb7501](#): > > I've added the user elastic to sudo and am trying the x-pack install now. The `elastic` user is an internal user that Elasticsearh uses and not an OS user so that would have no effect. It would probably be easier for you if you stick to one of the supported/suggested ways of installing Elasticsearch ( [pick your choice from here](https://www.elastic.co/guide/en/elasticsearch/reference/current/install-elasticsearch.html)) and make sure this works before moving on to x-pack installation. This will not only make it easier for you to do, but also for us to help you with any issues you encounter down the road (since we will know exactly what you have done already and at which point in the process you got stuck by an error ) ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 2, 2018, 7:33pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/15 "2018-05-02T19:33:28Z")
does this help: root@oc-elk:~/pkg# ls elasticsearch-6.2.1.deb root@oc-elk:~/pkg# root@oc-elk:~/pkg# history | grep elasticsearch-6.2.1.deb 84 dpkg -i elasticsearch-6.2.1.deb There is something I'm missing when installing x-pack or maybe the user that my elasticsearch cluster is running as (single-node). ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 2, 2018, 9:59pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/16 "2018-05-02T21:59:37Z")
Is it safe to assume you followed [this guide](https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html) to the point ? It's correct that you need to install x-pack with superuser privileges, it's also explicitly mentioned [in the documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/installing-xpack-es.html#xpack-package-installation). What's strange is that you're getting: ```auto Exception in thread "main" java.nio.file.FileSystemException: /etc/elasticsearch/x-pack/roles.yml: Operation not permitted ``` You shouldn't be getting this when you run ```auto bin/elasticsearch-plugin install x-pack ``` as root. Can you share the output of the commands: ```auto ls -la /etc/elasticsearch/ ``` ```auto whoami ``` and ```auto bin/elasticsearch-plugin install x-pack ``` (the last one after you have navigated to `/etc/elasticsearch` with ```auto cd /etc/elasticsearch ``` ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 3, 2018, 11:55am UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/17 "2018-05-03T11:55:16Z")
checking back on my installation: I have the repository configured: /etc/apt/sources.list.d/elastic-6.x.list I'm running as systemd: root@oc-elk:/etc/apt/sources.list.d# systemctl status elasticsearch.service ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2018-05-02 13:16:09 EDT; 18h ago Docs: [http://www.elastic.co](http://www.elastic.co) Main PID: 1153 (java) Tasks: 123 Memory: 5.5G CPU: 5h 26min 45.728s CGroup: /system.slice/elasticsearch.service └─1153 /usr/bin/java -Xms4g -Xmx4g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+ May 02 13:16:09 oc-elk systemd[1]: Started Elasticsearch. This is curious: root@oc-elk:/etc/apt/sources.list.d# curl -X GET "localhost:9200/" curl: (7) Failed to connect to localhost port 9200: Connection refused root@oc-elk:/usr/share/elasticsearch# bin/elasticsearch-plugin install x-pack -\> Downloading x-pack from elastic [=================================================] 100% @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: plugin requires additional permissions @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ - java.io.FilePermission \.\pipe\* read,write - java.lang.RuntimePermission accessClassInPackage.com.sun.activation.registries - java.lang.RuntimePermission getClassLoader - java.lang.RuntimePermission setContextClassLoader - java.lang.RuntimePermission setFactory - java.net.SocketPermission \* connect,accept,resolve - java.security.SecurityPermission createPolicy.JavaPolicy - java.security.SecurityPermission getPolicy - java.security.SecurityPermission putProviderProperty.BC - java.security.SecurityPermission setPolicy - java.util.PropertyPermission \* read,write See [http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html](http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html) for descriptions of what these permissions allow and the associated risks. Continue with installation? [y/N]y @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: plugin forks a native controller @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ This plugin launches a native controller that is not subject to the Java security manager nor to system call filters. Continue with installation? [y/N]y Elasticsearch keystore is required by plugin [x-pack-security], creating... -\> Installed x-pack with: x-pack-upgrade,x-pack-graph,x-pack-security,x-pack-watcher,x-pack-monitoring,x-pack-ml,x-pack-logstash,x-pack-deprecation,x-pack-core root@oc-elk:/usr/share/elasticsearch# ls -la /etc/elasticsearch/ total 44 drwxr-s--- 3 root elasticsearch 4096 May 3 07:53 . drwxr-xr-x 96 root root 4096 Apr 27 09:15 .. -rw-rw---- 1 root elasticsearch 418 May 3 07:53 elasticsearch.keystore -rw-r----- 1 root elasticsearch 2865 Apr 24 14:12 elasticsearch.yml -rw-rw---- 1 root elasticsearch 2866 Feb 14 08:26 elasticsearch.yml.dpkg-old -rw-r----- 1 root elasticsearch 2870 Feb 14 08:24 elasticsearch.yml.NEW -rw-r----- 1 root elasticsearch 2869 Feb 14 08:58 elasticsearch.yml.NEW\_621 -rw-rw---- 1 root elasticsearch 2809 Feb 14 12:13 jvm.options -rw-rw---- 1 root elasticsearch 5091 Nov 10 13:42 log4j2.properties drwxr-x--- 2 root elasticsearch 4096 May 3 07:53 x-pack ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 3, 2018, 12:57pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/18 "2018-05-03T12:57:32Z")
if im installing x-pack as root then following step 6 which is to start elasticsearch i get this output: root@oc-elk:/usr/share/elasticsearch# bin/elasticsearch [2018-05-03T08:57:09,524][WARN][o.e.b.ElasticsearchUncaughtExceptionHandler] [oc-elk] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:125) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.2.4.jar:6.2.4] at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:85) ~[elasticsearch-6.2.4.jar:6.2.4] Caused by: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:323) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) ~[elasticsearch-6.2.4.jar:6.2.4] ... 6 more ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 3, 2018, 1:15pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/19 "2018-05-03T13:15:43Z")
I used systemd to restart elasticsearch and here is the next step to configure user passwords: root@oc-elk:/usr/share/elasticsearch# bin/x-pack/setup-passwords interactive Connection failure to: [http://10.7.1.61:9200/\_xpack/security/\_authenticate?pretty](http://10.7.1.61:9200/_xpack/security/_authenticate?pretty) failed: Connection refused (Connection refused) ERROR: Failed to connect to elasticsearch at [http://10.7.1.61:9200/\_xpack/security/\_authenticate?pretty](http://10.7.1.61:9200/_xpack/security/_authenticate?pretty). Is the URL correct and elasticsearch running? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 3, 2018, 1:28pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/20 "2018-05-03T13:28:15Z")
> [@irb7501](#): > > if im installing x-pack as root then following step 6 which is to start elasticsearch i get this output: You should **not** run Elasticsearch as root. We have an explicit bootstrap check for this reason as you already found out. > [@irb7501](#): > > I used systemd to restart elasticsearch This is the suggested way to start elasticsearch. > [@irb7501](#): > > root@oc-elk:/etc/apt/sources.list.d# curl -X GET "localhost:9200/" > > curl: (7) Failed to connect to localhost port 9200: Connection refused > [@irb7501](#): > > Connection failure to: [http://10.7.1.61:9200/\_xpack/security/\_authenticate?pretty](http://10.7.1.61:9200/_xpack/security/_authenticate?pretty) failed: Connection refused (Connection refused) You first try to access it on localhost and then on 10.7.1.61, is this really where Elasticsearch is listening? This either means that something is blocking access to port 9200 or that Elasticsearch is not running. You should check to see if elasticsearch started correctly by looking at the logs. You can either check journal entries for errors ```auto sudo journalctl --unit elasticsearch ``` and/or check your logs at /var/log/elasticsearch.log for indications of what might have gone wrong. Also, when you run ```auto sudo netstat -nlp | grep 9200 ``` or ```auto ps aux | grep elasticsearch ``` what do you get ? Finally, you can show us your `elasticsearch.yml` file so that we can see how you have configured elasticsearch. [Next page](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849.md?page=2)