elk x-pack报错

es日志报错

image.png

[2018-07-17T15:48:48,525][INFO ][o.e.x.s.a.AuthenticationService] [iLxwotO] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]

kibana日志报错

image.png

[warning][license][xpack] License information from the X-Pack plugin could not be obtained from Elasticsearch for the [data] cluster. [security_exception] failed to authenticate user [elastic], with { header={ WWW-Authenticate="Basic realm="security" charset="UTF-8"" } } :: {"path":"/_xpack","statusCode":401,"response":"{"error":{"root_cause":[{"type":"security_exception","reason":"failed to authenticate user [elastic]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"failed to authenticate user [elastic]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}","wwwAuthenticateDirective":"Basic realm="security" charset="UTF-8""}
排查是删掉es的data目录导致删除了.security-6索引

image.png
解决：
bin / elasticsearch-setup-passwords auto | interactive

重置密码 auto：随机密码 interactive：手动设置
然后在es，kibana的配置文件重新指定密码 ok