# X-pack questions on installation **URL:** \ **Category:** Elasticsearch\ **Created:** [April 27, 2018, 3:00pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849 "2018-04-27T15:00:18Z")\ **Posts on this page:** 18\ **Page:** 2
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 3, 2018, 1:34pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/21 "2018-05-03T13:34:02Z")
root@oc-elk:/usr/share/elasticsearch# curl -X GET "10.7.1.61:9200/" {"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security\_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401} elk\_user@oc-elk:~$ sudo journalctl --unit elasticsearch -- Logs begin at Wed 2018-05-02 13:16:07 EDT, end at Thu 2018-05-03 09:32:31 EDT. -- May 02 13:16:09 oc-elk systemd[1]: Started Elasticsearch. May 03 08:58:04 oc-elk systemd[1]: Stopping Elasticsearch... May 03 08:58:12 oc-elk systemd[1]: Stopped Elasticsearch. May 03 08:58:12 oc-elk systemd[1]: Started Elasticsearch. elk\_user@oc-elk:~$ sudo netstat -nlp | grep 9200 tcp6 0 0 10.7.1.61:9200 :::\* LISTEN 43514/java elk\_user@oc-elk:~$ ps aux | grep elasticsearch elastic+ 43514 63.6 74.9 101618332 6122332 ? Ssl 08:58 22:31 /usr/bin/java -Xms4g -Xmx4g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.io.tmpdir=/tmp/elasticsearch.uNTeC9yy -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/lib/elasticsearch -XX:+PrintGCDetails -XX:+PrintGCDateStamps -XX:+PrintTenuringDistribution -XX:+PrintGCApplicationStoppedTime -Xloggc:/var/log/elasticsearch/gc.log -XX:+UseGCLogFileRotation -XX:NumberOfGCLogFiles=32 -XX:GCLogFileSize=64m -Des.path.home=/usr/share/elasticsearch -Des.path.conf=/etc/elasticsearch -cp /usr/share/elasticsearch/lib/\* org.elasticsearch.bootstrap.Elasticsearch -p /var/run/elasticsearch/elasticsearch.pid --quiet elastic+ 43597 0.0 0.0 135640 7156 ? Sl 08:58 0:00 /usr/share/elasticsearch/plugins/x-pack/x-pack-ml/platform/linux-x86\_64/bin/controller elk\_user 43902 0.0 0.0 14220 960 pts/0 R+ 09:33 0:00 grep --color=auto elasticsearch ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 3, 2018, 1:35pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/22 "2018-05-03T13:35:12Z")
elk\_user@oc-elk:~$ sudo cat /etc/elasticsearch/elasticsearch.yml # ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most settings. # Before you set out to tweak and tune the configuration, make sure you # understand what are you trying to accomplish and the consequences. # # The primary way of configuring a node is via this file. This template lists # the most important settings you may want to configure for a production cluster. # # Please consult the documentation for further information on configuration options: # [https://www.elastic.co/guide/en/elasticsearch/reference/index.html](https://www.elastic.co/guide/en/elasticsearch/reference/index.html) # # ---------------------------------- Cluster ----------------------------------- # # Use a descriptive name for your cluster: # cluster.name: ocs-elk-cluster # # ------------------------------------ Node ------------------------------------ # # Use a descriptive name for the node: # node.name: oc-elk # # Add custom attributes to the node: # #node.attr.rack: r1 # # ----------------------------------- Paths ------------------------------------ # # Path to directory where to store the data (separate multiple locations by comma): # path.data: /var/lib/elasticsearch # # Path to log files: # path.logs: /var/log/elasticsearch # # ----------------------------------- Memory ----------------------------------- # # Lock the memory on startup: # #bootstrap.memory\_lock: true # # Make sure that the heap size is set to about half the memory available # on the system and that the owner of the process is allowed to use this # limit. # # Elasticsearch performs poorly when the system is swapping the memory. # # ---------------------------------- Network ----------------------------------- # # Set the bind address to a specific IP (IPv4 or IPv6): # network.host: 10.7.1.61 # # Set a custom port for HTTP: # #http.port: 9200 # # For more information, consult the network module documentation. # # --------------------------------- Discovery ---------------------------------- # # Pass an initial list of hosts to perform discovery when new node is started: # The default list of hosts is ["127.0.0.1", "[::1]"] # #discovery.zen.ping.unicast.hosts: ["host1", "host2"] # # Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1): # #discovery.zen.minimum\_master\_nodes: # # For more information, consult the zen discovery module documentation. # # ---------------------------------- Gateway ----------------------------------- # # Block initial recovery after a full cluster restart until N nodes are started: # #gateway.recover\_after\_nodes: 3 # # For more information, consult the gateway module documentation. # # ---------------------------------- Various ----------------------------------- # # Require explicit names when deleting indices: # #action.destructive\_requires\_name: true thanks again for all the help. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 3, 2018, 1:38pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/23 "2018-05-03T13:38:52Z")
This > [@irb7501](#): > > root@oc-elk:/usr/share/elasticsearch# bin/x-pack/setup-passwords interactive > > Connection failure to: [http://10.7.1.61:9200/\_xpack/security/\_authenticate?pretty](http://10.7.1.61:9200/_xpack/security/_authenticate?pretty) failed: Connection refused (Connection refused) and this > [@irb7501](#): > > root@oc-elk:/usr/share/elasticsearch# curl -X GET "10.7.1.61:9200/" > > {"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security\_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401} cannot be both happening at the same time... Can you please run ```auto bin/x-pack/setup-passwords interactive -v ``` and share the output ? ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 3, 2018, 1:40pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/24 "2018-05-03T13:40:53Z")
root@oc-elk:/usr/share/elasticsearch# bin/x-pack/setup-passwords interactive -v Running with configuration path: /etc/elasticsearch Testing if bootstrap password is valid for [http://10.7.1.61:9200/\_xpack/security/\_authenticate?pretty](http://10.7.1.61:9200/_xpack/security/_authenticate?pretty) { "error" : { "root\_cause" : [ { "type" : "security\_exception", "reason" : "failed to authenticate user [elastic]", "header" : { "WWW-Authenticate" : "Basic realm="security" charset="UTF-8"" } } ], "type" : "security\_exception", "reason" : "failed to authenticate user [elastic]", "header" : { "WWW-Authenticate" : "Basic realm="security" charset="UTF-8"" } }, "status" : 401 } Failed to authenticate user 'elastic' against [http://10.7.1.61:9200/\_xpack/security/\_authenticate?pretty](http://10.7.1.61:9200/_xpack/security/_authenticate?pretty) Possible causes include: - The password for the 'elastic' user has already been changed on this cluster - Your elasticsearch node is running against a different keystore This tool used the keystore at /etc/elasticsearch/elasticsearch.keystore ERROR: Failed to verify bootstrap password ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 3, 2018, 7:23pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/25 "2018-05-03T19:23:16Z")
This would indicate that you have already run the `setup-passwords` command once successfully and set the password for the elastic user, can this be the case ? If you have set the password but don't remember what it is, you can do a "password reset" reading through the instructions and information in [the seminal post](https://discuss.elastic.co/t/x-pack-authentication-issue/121632/7) from @TimV ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 3, 2018, 7:41pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/26 "2018-05-03T19:41:31Z")
Yes I believe this is the case - that i have already run the setup-passwords command. I have set the password and do have it. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 3, 2018, 7:44pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/27 "2018-05-03T19:44:55Z")
Ok , then you don't need to run `setup-passwords` again. You have successfully installed X-Pack, you have set the passwords for your internal users, then you're good to go. To make authenticated requests to Elasticsearch you need to pass the `-u` parameter in curl , i.e. ```auto curl -X GET -u elastic "http://10.7.1.61:9200/" ``` and enter the password you had set once you are prompted ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 3, 2018, 7:45pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/28 "2018-05-03T19:45:57Z")
elk\_user@oc-elk:~$ curl -X GET -u elastic "[http://10.7.1.61:9200/](http://10.7.1.61:9200/)" Enter host password for user 'elastic': { "name" : "oc-elk", "cluster\_name" : "ocs-elk-cluster", "cluster\_uuid" : "He1zkCcOSnK5UlyqVr01LA", "version" : { "number" : "6.2.4", "build\_hash" : "ccec39f", "build\_date" : "2018-04-12T20:37:28.497551Z", "build\_snapshot" : false, "lucene\_version" : "7.2.1", "minimum\_wire\_compatibility\_version" : "5.6.0", "minimum\_index\_compatibility\_version" : "5.0.0" }, "tagline" : "You Know, for Search" } elk\_user@oc-elk:~$ ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 3, 2018, 7:52pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/29 "2018-05-03T19:52:01Z")
Awesome. Then I take it, that your issues have been resolved and your questions regarding the installation of X-pack have been answered ! ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 3, 2018, 7:52pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/30 "2018-05-03T19:52:50Z")
Thank you very much for all your time and assistance...This is a great resource. ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 4, 2018, 2:01pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/31 "2018-05-04T14:01:59Z")
I have successfully installed x-pack on elasticsearch, kibana, and logstash. I did not complete the TLS installation section. Is the TLS section necessary on a single node deployment? I have a trial license until June 2. The kibana console shows this trial license to be active. I cannot get the status from the command line: root@oc-elk:~# GET \_xpack/license/trial\_status Can't connect to \_xpack:80 Temporary failure in name resolution at /usr/share/perl5/LWP/Protocol/http.pm line 47. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 5, 2018, 8:39am UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/32 "2018-05-05T08:39:15Z")
> [@irb7501](#): > > I have successfully installed x-pack on elasticsearch, kibana, and logstash. I did not complete the TLS installation section. Is the TLS section necessary on a single node deployment? No, not while you're on a trial license or if you choose to continue with a license that doesn't enable X-Pack security. > [@irb7501](#): > > I have a trial license until June 2. The kibana console shows this trial license to be active. I cannot get the status from the command line: > > root@oc-elk:~# GET \_xpack/license/trial\_status > > Can't connect to \_xpack:80 The example from which you copy pasted that is meant as an instruction to be run via Kibana's dev console and not in your linux shell. In many linux distributions `GET` ( as in /usr/bin/GET ) is a symbolic link to [`lwp-request`](http://search.cpan.org/dist/libwww-perl/bin/lwp-request) and this is what throws this error. You either need to copy paste this command in your kibana dev console or click on the "Copy as curl" which will put ```auto curl -X GET "localhost:9200/_xpack/license/trial_status" ``` (adjust localhost to your IP Address) ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 7, 2018, 12:15pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/33 "2018-05-07T12:15:45Z")
good morning - thanks for the update...here is the result: {"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication token for REST request [/\_xpack/license/trial\_status]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security\_exception","reason":"missing authentication token for REST request [/\_xpack/license/trial\_status]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401} ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 7, 2018, 12:32pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/34 "2018-05-07T12:32:22Z")
As we discussed [above](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/27), now that you have X-Pack security enabled you need to make authenticated calls with CURL so you need to pass the `-u elastic` parameter. To be clear: There is nothing wrong with your installation, and there is no need to report here that the command will succeed. As you have already seen via Kibana the trial license is valid until June 2, you just want to access the same information directly from the Elasticsearch API. The response **will** be the same. ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 7, 2018, 1:20pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/35 "2018-05-07T13:20:19Z")
thank you for the clarification - here is the corrected result - i only want to ensure the licensing is correct - we will most likely purchase a license for this product very soon once i can get the PoC up root@oc-elk:/usr/share/elasticsearch# curl -X GET -u elastic "10.7.1.61:9200/\_xpack/license/trial\_status" Enter host password for user 'elastic': {"eligible\_to\_start\_trial":false} ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 7, 2018, 3:01pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/36 "2018-05-07T15:01:17Z")
You get only this result because `_xpack/license/trial_status` is the [trial status API](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/get-trial-status.html). If you want to get more details you should query the [Get license API](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/get-license.html) at `x_pack/license` that will return the expiration date and other information. ---
**Author:** ![irb7501](https://avatars.discourse-cdn.com/v4/letter/i/d9b06d/32.png) [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Post date:** [May 7, 2018, 6:37pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/37 "2018-05-07T18:37:22Z")
yes it looks like the installation is set. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 4, 2018, 6:37pm UTC](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849/38 "2018-06-04T18:37:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/x-pack-questions-on-installation/129849.md?page=1)