Kibana suddenly rejected our ROR Key

Enterprise Support
1

ROR Version: 1.61.1

Kibana Version: 7.17.26

Elasticsearch Version: 7.17.26

Steps to reproduce the issue

Our Kibana instance suddenly stopped recognizing our ROR activation key. No change of any kind was made from our side. We started seeing this screen instead of our usual Keycloak login:

image
image1169×686 53.9 KB

We restarted Kibana and after searching the logs we saw this messages:

[17:55:14:871] [debug][plugins][ReadonlyREST][LicenseService][x-ror-correlation-id=d8aca038-5b45-49de-ad3c-9bbb26d2f6e2] Found valid activation key in index:  {

Apr 22, 2025 @ 17:45:20.463		[17:45:20:463] [info][plugins][ReadonlyREST][LicenseService] No Activation Key found. That's OK. Defaulting to Free license.You can add your own Activation Key later.

Apr 22, 2025 @ 17:45:20.463		[17:45:20:463] [info][plugins][ReadonlyREST][LicenseService] Visit ReadonlyREST Customer Portal at https://readonlyrest.com to get a trial Activation Key.

Apr 22, 2025 @ 17:45:20.461		[17:45:20:459] [error][plugins][ReadonlyREST][LicenseService] ❌ Invalid Activation key TokenExpiredError: jwt expired

Apr 22, 2025 @ 17:45:20.457 	[17:45:20:457] [info][plugins][ReadonlyREST][LicenseService] Cannot get the encrypted activation key from Kibana... Status code: 429

Apr 22, 2025 @ 17:45:20.457		[17:45:20:457] [debug][plugins][ReadonlyREST][LicenseService] Trying to read the activation key from file (activationKeyFilePath):  /etc/kibana/ROR_ACTIVATION_KEY.txt

These logs are from before we restarted Kibana. Any idea of where those two errors might be coming from? Thank you in advance for your assistance.

Expected result:

Being able to read ROR activation key and login with keycloak.

Actual Result:

Kibana shows no valid activation key.

2

Hello @natalia.mellino

based on the

pr 22, 2025 @ 17:45:20.457 	[17:45:20:457] [info][plugins][ReadonlyREST][LicenseService] Cannot get the encrypted activation key from Kibana... Status code: 429

The plugin is not able to retrieve the .readonlyrest_license index from Elasticsearch due to a 429 error

Apr 22, 2025 @ 17:45:20.461		[17:45:20:459] [error][plugins][ReadonlyREST][LicenseService] ❌ Invalid Activation key TokenExpiredError: jwt expired

It seems like the log after trying to read a license from /etc/kibana/ROR_ACTIVATION_KEY.txt, which can expire. Could you verify if the license is up to date?

Could you set readonlyrest_kbn.logLevel: 'trace' in a Kibana.yml? We will receive an information in the Kibana logs, why there is a 429 error from elasticsearch.

3

If it’s a 429 (too many requests), maybe it’s cluster a performance issue: Elasticsearch Too Many Requests - How to Handle the Issue