Kibana Monitoring is not working

[kirubasankars (KIRUBA SANKAR SWAMINATHAN)]

elasticsearch: 6.2.3
readonlyrest: readonlyrest-1.16.29_es6.2.3

[ld57]

Hi,

with that information, it is mostly impossible to help you…

RoR kibana plugin installed or not ? using basic mode ?

readonlyrest.yml config ?

X-pack config ?

[kirubasankars (KIRUBA SANKAR SWAMINATHAN)]

Thank you for your help and appreciated.

kibana RoR is not installed and its basic mode.

readonlyrest.yml

access_control_rules:

- name: elastic
  auth_key_unix: elastic:xxx
  verbosity: error

- name: kibana
  auth_key_unix: kibana:xxx
  verbosity: error

- name: admin
  ldap_authentication: "ldap1"
  ldap_authorization:
    name: "ldap1"
    groups: ["xxx-admin"]

- name: application
  ldap_authentication:
    name: "ldap1"
    cache_ttl_in_sec: 60
    groups: ["xxx_app1"]
  actions: ["cluster:monitor/main","indices:admin/types/exists","indices:data/read/*","indices:data/write/*","indices:admin/create", "indices:admin/delete"]

- name: users
  ldap_authentication:
    name: "ldap1"
    cache_ttl_in_sec: 60
    groups: ["xxx-debug"]
  actions: ["cluster:monitor/main","indices:admin/types/exists","indices:data/read/*","indices:data/write/*"]


ldaps:

- name: ldap1

  host: "xxx.local"
  port: 389
  ssl_enabled: false
  ssl_trust_all_certs: true

  bind_dn: "CN=xxx,OU=Service Accounts,OU=Users,OU=xxx,OU=xxx,DC=xxx,DC=xxx"
  bind_password: "xxx"

  user_id_attribute: "userPrincipalName"
  search_user_base_DN: "DC=xxx,DC=xxx"
  search_groups_base_DN: "DC=xxx,DC=xxx"
  unique_member_attribute: "member"
  group_search_filter: "(objectClass=group)(cn=xxx*)"
  group_name_attribute: "xxx"

  connection_pool_size: 10
  connection_timeout_in_sec: 10
  request_timeout_in_sec: 10
  cache_ttl_in_sec: 60

elasticsearch.yml

xpack.security.enabled: false

[metsaviha]

Just use the forum search, this issue was discussed several times here, including possible workarounds:
e.g. :

[ISSUE] Unable to access monitoring in Kibana after setting up basic authentication

EDIT: ReadonlyREST plugins for Kibana (Enterprise and PRO) are finally able compensate the Kibana bug and X-Pack Monitoring works normally out of the box. No need for hacks! :warning:WARNING THE SOLUTION BELOW IS A HACK AND MAY MESS UP YOUR ACL, PLEASE MIND THE ORDER OF THE ACL BLOCKS AND THINK ABOUT ALL THE RAMIFICATIONS Finally I had a break through but via work around rule. Based on the kibana error log, I checked their clusters.js code. This is internally calling verify_monitoring_au…

[kirubasankars (KIRUBA SANKAR SWAMINATHAN)]

will monitoring work with readonlyrest enterprise without hack?

[ld57]

yep, it is not related to RoR.

but you will need to define access to indice “.monitoring*”

also in your rule (users ones) , I do not see any indices pattern definition, is it normal ?

[sscarduzio (Simone Scarduzio)]

Dear all,
That post with the hack was really old. We have added a sensible workaround in ReadonlyREST Enterprise, so that that when a user is allowed to see Monitoring, the missing credentials are injected by our plugin.

Please see the below screenshot of the latest Kibana 6.5.1 running the monitoring app, sporting multi tenancy and the tenancy selector dropdown menu.

[askids]

@sscarduzio

That post with the hack was really old

Not really that old. Just used it few days back in v6.2.4 running ROR free edition with a slight adjustment on the index list. But I am glad that a better solution exists now.