Could not authenticate: Empty metadata in kibana metricbeat

Users Feedback
1

I have ROR 1.40.0 free kibana/elasticsearch plugin and all is working but I get an error getting metricbeat metrics from kibana

kibana side
[info][plugins][ReadonlyREST][authController] Could not authenticate: Empty metadata

metricbeat side
{“log.level”:“error”,“@timestamp”:“2022-06-14T09:36:38.825+0200”,“log.origin”:{“file.name”:“module/wrapper.go”,“file.line”:254},“message”:“Error fetching data for metricset kibana.stats: error trying to get stats data from Kibana: HTTP error 401 in : 401 Unauthorized”,“service.name”:“metricbeat”,“ecs.version”:“1.6.0”}

metricbeat settings

curl ‘http://xxx.xxx.xxx.xxx:5601/api/status’ is working

2

ok the point was to add
readonlyrest_kbn.whitelistedPaths: [".*api/stats$", “.*api/status$”]

thank you all xd

1 Like
3

You need to add credentials to metricbeat settings:

For example if your readonlyrest.yml has an ACL block to authenticate Kibana → Elasticsearch communication, i.e.

readonlyrest:
  access_control_rules:

  - name: KIBANA_SERVER_AUTHENTICATION
    auth_key: kibana:kibana
    verbosity: error

Then you can configure metricbeat with the same credentials:

setup.kibana:
  host: "mykibanahost:5601"
  username: "kibana" 
  password: "kibana"

This will work because Metricbeat talks to Kibana via the Kibana API (URL path starting with /api/), and ROR accepts HTTP Basic auth for those paths.

4

Sure, this works OK too, but… you are leaving these endpoints without authentication :slight_smile:

5

True, that solutions is bettter but i has been configured in the module. I mean
kibana-xpack.yml
…

  • module: kibana
    username: “XXXXX”
    password: “XXXX”
    …
6

This file is irrelevant when ReadonlyREST is installed.