42

I'm just start to use elasticsearch. Created an index with default settings (5 shards, 1 replica). I then indexed ~13G text files with the attachment plugin. As a result, it went very slow searching in Kibana Discover. However, searching in the console is fast:

GET /mytext/_search
{
  "fields": [ "file.name" ],
  "query": {
    "match": {
      "file.content": "foobar"
    }
  },
  "highlight": {
    "fields": {
      "file.content": {
      }
    }
  }
}

To investigate why it's so slow, I installed X-Pack. The guide documentation seems not comprehensive, I didn't get to the security config.

The default install of elasticsearch don't have to be logged in, but it have to be logged in after installed X-Pack plugin. I'm confused with the security settings of elasticsearch, kibana, x-pack, do they share the user accounts whatever? After all, I get the authentication works by:

curl -XPUT -uelastic:changeme 'localhost:9200/_shield/user/elastic/_password' -d '{ "password" : "newpass1" }'
curl -XPUT -uelastic:newpass1 'localhost:9200/_shield/user/kibana/_password' -d '{ "password" : "newpass2" }'

Here comes the problem. I can't login using Java client with org.elasticsearch.plugin:shield. It's likely the latest version of the shield dependency (2.3.3) mismatched with the elasticsearch dependency (5.0.0-alpha).

Well, can I just disable the authentication?

From the node config:

GET http://localhost:9200/_nodes

"nodes" : {
    "v_XmZh7jQCiIMYCG2AFhJg" : {
        "transport_address" : "127.0.0.1:9300",
        "version" : "5.0.0-alpha2",
        "roles" : [ "master", "data", "ingest" ],
        ...
        "settings" : {
            "node" : {
                "name" : "Apache Kid"
            },
            "http" : {
                "type" : "security"
            },
            "transport" : {
                "type" : "security",
                "service" : {
                    "type" : "security"
                }
            },
...

So, can I modify these settings, and the possible values are?

5 Answers 5

121

In a test environment I added the following option to elasticsearch.yml, and/or kibana.yml

xpack.security.enabled: false
3
  • 2
    this is the correct answer. source: elastic.co/guide/en/x-pack/current/security-settings.html
    – Alexey
    Oct 27, 2016 at 17:06
  • 5
    elasticsearch.yml file is located at /usr/share/elasticsearch/config/elasticsearch.yml
    – Lebnik
    May 12, 2017 at 11:12
  • 19
    If using docker-compose, put - "xpack.security.enabled=false" under environment key in both es and kibana section.
    – TonyLxc
    Sep 7, 2017 at 0:44
25

assuming that your image name is elasticsearch. you can use id if you don't like name

if you run docker you can use this. go to bash in docker with command

docker exec -i -t elasticsearch /bin/bash

then remove x-pack

elasticsearch-plugin remove x-pack

exit docker

exit

and restart docker image

docker restart elasticsearch

Disclamer: Solution inspired by Michał Dymel

13

When using with docker (in local dev), instead of removing the xpack, you can simply disable it.

docker pull docker.elastic.co/elasticsearch/elasticsearch:5.5.3
docker run -p 9200:9200 \
    -p 9300:9300 \
    -e "discovery.type=single-node" \
    -e "xpack.security.enabled=false" \
    docker.elastic.co/elasticsearch/elasticsearch:5.5.3
3

I've managed to authenticate using this xpack_security_enable equals false but I still getting some authentication errors on my kibana log.

elasticsearch:
    image: elasticsearch:1.7.6
    ports:
      - ${PIM_ELASTICSEARCH_PORT}:9200
      - 9300:9300
kibana:
    image: docker.elastic.co/kibana/kibana:5.4.1
    environment:
      SERVER_NAME: localhost
      ELASTICSEARCH_URL: http://localhost:9200
      XPACK_SECURITY_ENABLED: 'false'
    ports:
      - 5601:5601
    links:
      - elasticsearch
    depends_on:
      - elasticsearch

This is my current setup, on the kibana I can see some errors: KIBANA dashboard

On kibana logs I can see:

kibana_1         | {"type":"log","@timestamp":"2017-06-15T07:43:41Z","tags":["warning","elasticsearch","admin"],"pid":1,"message":"No living connections"}
kibana_1         | {"type":"log","@timestamp":"2017-06-15T07:43:42Z","tags":["warning","elasticsearch","admin"],"pid":1,"message":"Unable to revive connection: http://localhost:9200/"}

So it seems it still trying to connect using authentication.

1
  • 1
    You can solve Kibana warnings by specifying: - ELASTICSEARCH_URL=http://elasticsearch:9200 under environment key in kibana section of your docker.compose file.
    – radzak
    Jan 25, 2019 at 13:38
0

I had same xpack issue but with kibana, fixed by following command:

docker run docker.elastic.co/kibana/kibana:5.5.1 /bin/bash -c 'bin/kibana-plugin remove x-pack ; /usr/local/bin/kibana-docker'

so it start container, than removes xpack and after that starts normal process. Same can be done with elasticsearch and logstash.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.