Elasticsearch / Logstash 7.0.1 & Readonlyrest v1.18.0 Enterprise

Users Feedback
1

Hello,

I use Elasticsearch and Logstash 7.0.1 OSS (Apache 2).
When I start Logstash, I get the following error :

[ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Got response code '403' contacting Elasticsearch at URL 'http://localhost:9200/_xpack'"

In Elasticsearch, I get this error :

 FORBIDDEN by default req={  ID:541074871-1835867784#4169,  TYP:GetIndexRequest,  CGR:N/A,  USR:[user not logged],  BRS:true,  KDX:null,  ACT:indices:admin/get,  OA:127.0.0.1/32,  XFF:null,  DA:127.0.0.1/32,  IDX:<N/A>,  MET:GET,  PTH:/_xpack,  CNT:<N/A>,  HDR:Accept-Encoding=gzip,deflate, Authorization=<OMITTED>, Connection=Keep-Alive, Content-Length=0, Content-Type=application/json, Host=localhost:9200, User-Agent=Manticore 0.6.4,  HIS:[logstash with write and create permissions for its own indices->[auth_key->true, indices->false]], [Kibana Server->[auth_key->false]], [Application users->[ldap_auth->false]], [Administrator->[ldap_auth->false]]  }

Thanks for help
H.

2

Hi Hassen,

Can you make sure you are using the OSS version of Logstash too?

3

Hi Simone,

I just checked and I am sure that I am using Logstash OSS.

When I run the command to find the files which contain “_xpack”, I get this :

.../vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.0.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:378:      get("/_xpack")