Elasticsearch not generating token #504
Replies: 11 comments 11 replies
-
@Quarrymann did you have any luck? I’d be curious as to what’s causing the issue. However, docker hasn’t been my go-to as the easiest to setup and get up and running. |
Beta Was this translation helpful? Give feedback.
-
I am running Ubuntu 22.04.3. "The exact error was "must set xpack.security.enrollment.enabled true" Also, thank you for replying. I was not ever expecting help on my rant. James |
Beta Was this translation helpful? Give feedback.
-
And step 22 wont run. sed -i 's?ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"?ExecStart=/usr/share/logstash/bin/logstash "--pipeline.unsafe_shutdown" "--path.settings" "/etc/logstash"?' /etc/systemd/system/logstash.service sed: can't read /etc/systemd/system/logstash.service: No such file or directory |
Beta Was this translation helpful? Give feedback.
-
run this, It should display the Elasticsearch.yml file...let me know if it looks like this or a # precedes the setting:
|
Beta Was this translation helpful? Give feedback.
-
Gandorf
…On Fri, Sep 1, 2023 at 7:44 PM Andrew ***@***.***> wrote:
a3ilson on discord
—
Reply to this email directly, view it on GitHub
<#504 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AFRY47PGAJNE5YVIOBGOJ73XYKMQFANCNFSM6AAAAAA4AEBHAI>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
Elasticsearch is not starting now.
elasticsearch.service - Elasticsearch
Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled;
vendor>
Active: failed (Result: exit-code) since Fri 2023-09-01 20:33:21 PDT;
1min>
Docs: https://www.elastic.co
Process: 6148 ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint
-p >
Main PID: 6148 (code=exited, status=1/FAILURE)
CPU: 46.186s
Sep 01 20:33:05 elk-server systemd[1]: Starting Elasticsearch...
Sep 01 20:33:20 elk-server systemd-entrypoint[6148]: ERROR: Elasticsearch
did n>
Sep 01 20:33:21 elk-server systemd-entrypoint[6148]: ERROR: Elasticsearch
exite>
Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Main process
exit>
Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Failed with
resul>
Sep 01 20:33:21 elk-server systemd[1]: Failed to start Elasticsearch.
Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Consumed
46.186s >
…-----------------------------
journalctl -xeu elasticsearch.service
░░ An ExecStart= process belonging to unit elasticsearch.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
Sep 01 20:35:25 elk-server systemd[1]: elasticsearch.service: Failed with
resul>
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ The unit elasticsearch.service has entered the 'failed' state with
result 'e>
Sep 01 20:35:25 elk-server systemd[1]: Failed to start Elasticsearch.
░░ Subject: A start job for unit elasticsearch.service has failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit elasticsearch.service has finished with a failure.
░░
░░ The job identifier is 8114 and the job result is failed.
Sep 01 20:35:25 elk-server systemd[1]: elasticsearch.service: Consumed
46.025s >
░░ Subject: Resources consumed by unit runtime
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ The unit elasticsearch.service completed and consumed the indicated
resource>
On Fri, Sep 1, 2023 at 7:54 PM Andrew ***@***.***> wrote:
run this, sudo cat /etc/elasticsearch/elasticsearch.yml
It should display the Elasticsearch.yml file...let me know if it looks
like this or a # precedes the setting:
# Enable security features
xpack.security.enabled: true
—
Reply to this email directly, view it on GitHub
<#504 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AFRY47MCXMNI5U2L6MBZP5DXYKNW7ANCNFSM6AAAAAA4AEBHAI>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
If I comment out all the lines you added then ES will run.
$ systemctl status elasticsearch
● elasticsearch.service - Elasticsearch
Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled;
vendor>
Active: active (running) since Fri 2023-09-01 20:42:29 PDT; 11s ago
Docs: https://www.elastic.co
Main PID: 9774 (java)
Tasks: 120 (limit: 18954)
Memory: 8.5G
CPU: 1min 12.596s
CGroup: /system.slice/elasticsearch.service
├─9774 /usr/share/elasticsearch/jdk/bin/java -Xms4m -Xmx64m
-XX:+U>
├─9837 /usr/share/elasticsearch/jdk/bin/java
-Des.networkaddress.c>
└─9865
/usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x>
Sep 01 20:42:09 elk-server systemd[1]: Starting Elasticsearch...
Sep 01 20:42:29 elk-server systemd[1]: Started Elasticsearch.
…On Fri, Sep 1, 2023 at 8:43 PM James Manson ***@***.***> wrote:
Elasticsearch is not starting now.
elasticsearch.service - Elasticsearch
Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled;
vendor>
Active: failed (Result: exit-code) since Fri 2023-09-01 20:33:21 PDT;
1min>
Docs: https://www.elastic.co
Process: 6148
ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint -p >
Main PID: 6148 (code=exited, status=1/FAILURE)
CPU: 46.186s
Sep 01 20:33:05 elk-server systemd[1]: Starting Elasticsearch...
Sep 01 20:33:20 elk-server systemd-entrypoint[6148]: ERROR: Elasticsearch
did n>
Sep 01 20:33:21 elk-server systemd-entrypoint[6148]: ERROR: Elasticsearch
exite>
Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Main process
exit>
Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Failed with
resul>
Sep 01 20:33:21 elk-server systemd[1]: Failed to start Elasticsearch.
Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Consumed
46.186s >
-----------------------------
journalctl -xeu elasticsearch.service
░░ An ExecStart= process belonging to unit elasticsearch.service has
exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
Sep 01 20:35:25 elk-server systemd[1]: elasticsearch.service: Failed with
resul>
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ The unit elasticsearch.service has entered the 'failed' state with
result 'e>
Sep 01 20:35:25 elk-server systemd[1]: Failed to start Elasticsearch.
░░ Subject: A start job for unit elasticsearch.service has failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit elasticsearch.service has finished with a failure.
░░
░░ The job identifier is 8114 and the job result is failed.
Sep 01 20:35:25 elk-server systemd[1]: elasticsearch.service: Consumed
46.025s >
░░ Subject: Resources consumed by unit runtime
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ The unit elasticsearch.service completed and consumed the indicated
resource>
On Fri, Sep 1, 2023 at 7:54 PM Andrew ***@***.***> wrote:
> run this, sudo cat /etc/elasticsearch/elasticsearch.yml
>
> It should display the Elasticsearch.yml file...let me know if it looks
> like this or a # precedes the setting:
>
> # Enable security features
> xpack.security.enabled: true
>
> —
> Reply to this email directly, view it on GitHub
> <#504 (comment)>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AFRY47MCXMNI5U2L6MBZP5DXYKNW7ANCNFSM6AAAAAA4AEBHAI>
> .
> You are receiving this because you were mentioned.Message ID:
> ***@***.***>
>
|
Beta Was this translation helpful? Give feedback.
-
This is normal for my experience.
failed something-- how is it this installs everything except the last
part---- ????? i can sudo nano that file but it is empty. but it does
exist. And it was created by the apt install---
Is there some base program I am missing to pass sudo permissions.... it is
just so frustrating.
Selecting previously unselected package logstash.
(Reading database ... 207871 files and directories currently installed.)
Preparing to unpack .../logstash_1%3a8.9.1-1_amd64.deb ...
Unpacking logstash (1:8.9.1-1) ...
Setting up logstash (1:8.9.1-1) ...
sed: can't read /etc/logstash/logstash.yml: No such file or directory
chmod: cannot access '/etc/logstash/startup.options': No such file or
directory
Scanning processes...
…On Fri, Sep 1, 2023 at 8:43 PM James Manson ***@***.***> wrote:
If I comment out all the lines you added then ES will run.
$ systemctl status elasticsearch
● elasticsearch.service - Elasticsearch
Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled;
vendor>
Active: active (running) since Fri 2023-09-01 20:42:29 PDT; 11s ago
Docs: https://www.elastic.co
Main PID: 9774 (java)
Tasks: 120 (limit: 18954)
Memory: 8.5G
CPU: 1min 12.596s
CGroup: /system.slice/elasticsearch.service
├─9774 /usr/share/elasticsearch/jdk/bin/java -Xms4m -Xmx64m
-XX:+U>
├─9837 /usr/share/elasticsearch/jdk/bin/java
-Des.networkaddress.c>
└─9865
/usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x>
Sep 01 20:42:09 elk-server systemd[1]: Starting Elasticsearch...
Sep 01 20:42:29 elk-server systemd[1]: Started Elasticsearch.
On Fri, Sep 1, 2023 at 8:43 PM James Manson ***@***.***> wrote:
> Elasticsearch is not starting now.
>
> elasticsearch.service - Elasticsearch
> Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled;
> vendor>
> Active: failed (Result: exit-code) since Fri 2023-09-01 20:33:21
> PDT; 1min>
> Docs: https://www.elastic.co
> Process: 6148
> ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint -p >
> Main PID: 6148 (code=exited, status=1/FAILURE)
> CPU: 46.186s
>
> Sep 01 20:33:05 elk-server systemd[1]: Starting Elasticsearch...
> Sep 01 20:33:20 elk-server systemd-entrypoint[6148]: ERROR: Elasticsearch
> did n>
> Sep 01 20:33:21 elk-server systemd-entrypoint[6148]: ERROR: Elasticsearch
> exite>
> Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Main
> process exit>
> Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Failed with
> resul>
> Sep 01 20:33:21 elk-server systemd[1]: Failed to start Elasticsearch.
> Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Consumed
> 46.186s >
>
> -----------------------------
> journalctl -xeu elasticsearch.service
> ░░ An ExecStart= process belonging to unit elasticsearch.service has
> exited.
> ░░
> ░░ The process' exit code is 'exited' and its exit status is 1.
> Sep 01 20:35:25 elk-server systemd[1]: elasticsearch.service: Failed with
> resul>
> ░░ Subject: Unit failed
> ░░ Defined-By: systemd
> ░░ Support: http://www.ubuntu.com/support
> ░░
> ░░ The unit elasticsearch.service has entered the 'failed' state with
> result 'e>
> Sep 01 20:35:25 elk-server systemd[1]: Failed to start Elasticsearch.
> ░░ Subject: A start job for unit elasticsearch.service has failed
> ░░ Defined-By: systemd
> ░░ Support: http://www.ubuntu.com/support
> ░░
> ░░ A start job for unit elasticsearch.service has finished with a failure.
> ░░
> ░░ The job identifier is 8114 and the job result is failed.
> Sep 01 20:35:25 elk-server systemd[1]: elasticsearch.service: Consumed
> 46.025s >
> ░░ Subject: Resources consumed by unit runtime
> ░░ Defined-By: systemd
> ░░ Support: http://www.ubuntu.com/support
> ░░
> ░░ The unit elasticsearch.service completed and consumed the indicated
> resource>
>
> On Fri, Sep 1, 2023 at 7:54 PM Andrew ***@***.***> wrote:
>
>> run this, sudo cat /etc/elasticsearch/elasticsearch.yml
>>
>> It should display the Elasticsearch.yml file...let me know if it looks
>> like this or a # precedes the setting:
>>
>> # Enable security features
>> xpack.security.enabled: true
>>
>> —
>> Reply to this email directly, view it on GitHub
>> <#504 (comment)>,
>> or unsubscribe
>> <https://github.com/notifications/unsubscribe-auth/AFRY47MCXMNI5U2L6MBZP5DXYKNW7ANCNFSM6AAAAAA4AEBHAI>
>> .
>> You are receiving this because you were mentioned.Message ID:
>> ***@***.***>
>>
>
|
Beta Was this translation helpful? Give feedback.
-
*I went through every line of code your screen shows during install and
they differ as well.*
*Elasticsearch installs first and I notice you have these 2 lines that I do
not.*
*->creating elasticsearch group...ok*
*->creating elasticsearch user...ok*
I do not see those lines during my install. It skips them
copy/paste from my install
----------------
Setting up elasticsearch (8.9.1) ...
Created elasticsearch keystore in /etc/elasticsearch/elasticsearch.keystore
Scanning processes...
Scanning processor microcode...
Scanning linux images...
Running kernel seems to be up-to-date.
-----------------------------------
*Same thing in Kibana--- missing same 2 lines*
*->creating kibana group... ok*
*->creating kibana user... ok*
-----------------------
The following NEW packages will be installed:
kibana
0 upgraded, 1 newly installed, 0 to remove and 1 not upgraded.
Need to get 288 MB of archives.
After this operation, 768 MB of additional disk space will be used.
Get:1 https://artifacts.elastic.co/packages/8.x/apt stable/main amd64
kibana amd64 8.9.1 [288 MB]
Fetched 288 MB in 7s (42.8 MB/s)
Selecting previously unselected package kibana.
(Reading database ... 130695 files and directories currently installed.)
Preparing to unpack .../kibana_8.9.1_amd64.deb ...
Unpacking kibana (8.9.1) ...
Setting up kibana (8.9.1) ...
Restarting kibana service... OK
Created Kibana keystore in /etc/kibana/kibana.keystore
Scanning processes...
Scanning processor microcode...
Scanning linux images...
Running kernel seems to be up-to-date.
-------------------
[image: image.png]
…On Sat, Sep 2, 2023 at 4:26 PM James Manson ***@***.***> wrote:
This is normal for my experience.
failed something-- how is it this installs everything except the last
part---- ????? i can sudo nano that file but it is empty. but it does
exist. And it was created by the apt install---
Is there some base program I am missing to pass sudo permissions.... it is
just so frustrating.
Selecting previously unselected package logstash.
(Reading database ... 207871 files and directories currently installed.)
Preparing to unpack .../logstash_1%3a8.9.1-1_amd64.deb ...
Unpacking logstash (1:8.9.1-1) ...
Setting up logstash (1:8.9.1-1) ...
sed: can't read /etc/logstash/logstash.yml: No such file or directory
chmod: cannot access '/etc/logstash/startup.options': No such file or
directory
Scanning processes...
On Fri, Sep 1, 2023 at 8:43 PM James Manson ***@***.***> wrote:
> If I comment out all the lines you added then ES will run.
>
> $ systemctl status elasticsearch
> ● elasticsearch.service - Elasticsearch
> Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled;
> vendor>
> Active: active (running) since Fri 2023-09-01 20:42:29 PDT; 11s ago
> Docs: https://www.elastic.co
> Main PID: 9774 (java)
> Tasks: 120 (limit: 18954)
> Memory: 8.5G
> CPU: 1min 12.596s
> CGroup: /system.slice/elasticsearch.service
> ├─9774 /usr/share/elasticsearch/jdk/bin/java -Xms4m -Xmx64m
> -XX:+U>
> ├─9837 /usr/share/elasticsearch/jdk/bin/java
> -Des.networkaddress.c>
> └─9865
> /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x>
>
> Sep 01 20:42:09 elk-server systemd[1]: Starting Elasticsearch...
> Sep 01 20:42:29 elk-server systemd[1]: Started Elasticsearch.
>
> On Fri, Sep 1, 2023 at 8:43 PM James Manson ***@***.***> wrote:
>
>> Elasticsearch is not starting now.
>>
>> elasticsearch.service - Elasticsearch
>> Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled;
>> vendor>
>> Active: failed (Result: exit-code) since Fri 2023-09-01 20:33:21
>> PDT; 1min>
>> Docs: https://www.elastic.co
>> Process: 6148
>> ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint -p >
>> Main PID: 6148 (code=exited, status=1/FAILURE)
>> CPU: 46.186s
>>
>> Sep 01 20:33:05 elk-server systemd[1]: Starting Elasticsearch...
>> Sep 01 20:33:20 elk-server systemd-entrypoint[6148]: ERROR:
>> Elasticsearch did n>
>> Sep 01 20:33:21 elk-server systemd-entrypoint[6148]: ERROR:
>> Elasticsearch exite>
>> Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Main
>> process exit>
>> Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Failed
>> with resul>
>> Sep 01 20:33:21 elk-server systemd[1]: Failed to start Elasticsearch.
>> Sep 01 20:33:21 elk-server systemd[1]: elasticsearch.service: Consumed
>> 46.186s >
>>
>> -----------------------------
>> journalctl -xeu elasticsearch.service
>> ░░ An ExecStart= process belonging to unit elasticsearch.service has
>> exited.
>> ░░
>> ░░ The process' exit code is 'exited' and its exit status is 1.
>> Sep 01 20:35:25 elk-server systemd[1]: elasticsearch.service: Failed
>> with resul>
>> ░░ Subject: Unit failed
>> ░░ Defined-By: systemd
>> ░░ Support: http://www.ubuntu.com/support
>> ░░
>> ░░ The unit elasticsearch.service has entered the 'failed' state with
>> result 'e>
>> Sep 01 20:35:25 elk-server systemd[1]: Failed to start Elasticsearch.
>> ░░ Subject: A start job for unit elasticsearch.service has failed
>> ░░ Defined-By: systemd
>> ░░ Support: http://www.ubuntu.com/support
>> ░░
>> ░░ A start job for unit elasticsearch.service has finished with a
>> failure.
>> ░░
>> ░░ The job identifier is 8114 and the job result is failed.
>> Sep 01 20:35:25 elk-server systemd[1]: elasticsearch.service: Consumed
>> 46.025s >
>> ░░ Subject: Resources consumed by unit runtime
>> ░░ Defined-By: systemd
>> ░░ Support: http://www.ubuntu.com/support
>> ░░
>> ░░ The unit elasticsearch.service completed and consumed the indicated
>> resource>
>>
>> On Fri, Sep 1, 2023 at 7:54 PM Andrew ***@***.***> wrote:
>>
>>> run this, sudo cat /etc/elasticsearch/elasticsearch.yml
>>>
>>> It should display the Elasticsearch.yml file...let me know if it looks
>>> like this or a # precedes the setting:
>>>
>>> # Enable security features
>>> xpack.security.enabled: true
>>>
>>> —
>>> Reply to this email directly, view it on GitHub
>>> <#504 (comment)>,
>>> or unsubscribe
>>> <https://github.com/notifications/unsubscribe-auth/AFRY47MCXMNI5U2L6MBZP5DXYKNW7ANCNFSM6AAAAAA4AEBHAI>
>>> .
>>> You are receiving this because you were mentioned.Message ID:
>>> ***@***.***>
>>>
>>
|
Beta Was this translation helpful? Give feedback.
-
The group & users were likely created from a prior instance. I do not believe they are removed when removing Elasticsearch/Kibana/Logstash. I doubt that'll be any issue... however, when you removed via I'd give this a try instead, which should remove all files system-wide by purging all data |
Beta Was this translation helpful? Give feedback.
-
Did not remove everything
sudo apt-get purge elasticsearch kibana logstash
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages will be REMOVED:
elasticsearch* kibana* logstash*
0 upgraded, 0 newly installed, 3 to remove and 1 not upgraded.
After this operation, 2,619 MB disk space will be freed.
Do you want to continue? [Y/n] y
(Reading database ... 222485 files and directories currently installed.)
Removing elasticsearch (8.9.1) ...
Stopping elasticsearch service... OK
Removing kibana (8.9.1) ...
Stopping kibana service... OK
Removing logstash (1:8.9.1-1) ...
(Reading database ... 129397 files and directories currently installed.)
Purging configuration files for elasticsearch (8.9.1) ...
Deleting security auto-configuration directory...OK
Deleting elasticsearch.keystore...OK
dpkg: warning: while removing elasticsearch, directory
'/var/lib/elasticsearch' not empty so not removed
Purging configuration files for kibana (8.9.1) ...
dpkg: warning: while removing kibana, directory '/etc/kibana' not empty so
not removed
dpkg: warning: while removing kibana, directory '/var/lib/kibana' not empty
so not removed
dpkg: warning: while removing kibana, directory '/usr/lib/systemd/system'
not empty so not removed
Purging configuration files for logstash (1:8.9.1-1) ...
dpkg: warning: while removing logstash, directory '/var/lib/logstash' not
empty so not removed
dpkg: warning: while removing logstash, directory '/var/log/logstash' not
empty so not removed
…On Sat, Sep 2, 2023 at 4:56 PM Andrew ***@***.***> wrote:
The group & users were likely created from a prior instance. I do not
believe they are removed when removing Elasticsearch/Kibana/Logstash.
I doubt that'll be any issue... however, when you removed via sudo
apt-get remove elasticsearch kibana logstash
I'd give this a try instead, which should remove all files system-wide by
purging all data sudo apt-get purge elasticsearch kibana logstash
—
Reply to this email directly, view it on GitHub
<#504 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AFRY47OI5EUUZKE5MQ3JCE3XYPBSBANCNFSM6AAAAAA4AEBHAI>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
It never fails. I am a noob for linux, but I have spent many hours on these auto installs and never have I had one complete w/o errors.
I ran 14 install last year using docker compose and every one failed for different errors.
I finally see there is a new script version....awesome.
Installed Debian 12--- ran the scripts.... loosk good. Get to the end and no token generated. SSL cert error. uuhg.
Gonna try again on ubuntu 22.04- will update tomorrow.
Beta Was this translation helpful? Give feedback.
All reactions