[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-elasticsearch-security-troubleshooting":3,"mdc--ii7uwk-key":34,"related-org-elastic-elasticsearch-security-troubleshooting":4586,"related-repo-elastic-elasticsearch-security-troubleshooting":4748},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"elasticsearch-security-troubleshooting","troubleshoot Elasticsearch security and TLS errors","Diagnose and resolve Elasticsearch security errors: 401\u002F403 failures, TLS problems, expired API keys, role mapping mismatches, and Kibana login issues. Use when the user reports a security error.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,17,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Elasticsearch","elasticsearch",{"name":21,"slug":22,"type":15},"Debugging","debugging",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:47:44.549882",null,41,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fplugins\u002Felasticsearch\u002Fskills\u002Felasticsearch-security-troubleshooting","---\nname: elasticsearch-security-troubleshooting\ndescription: >\n  Diagnose and resolve Elasticsearch security errors: 401\u002F403 failures, TLS problems,\n  expired API keys, role mapping mismatches, and Kibana login issues. Use when the\n  user reports a security error.\nmetadata:\n  author: elastic\n  version: 0.1.0\n---\n\n# Elasticsearch Security Troubleshooting\n\nDiagnose and resolve common Elasticsearch security issues. This skill provides a structured triage workflow for\nauthentication failures, authorization errors, TLS problems, API key issues, role mapping mismatches, Kibana login\nfailures, and license-expiry lockouts.\n\nFor authentication methods and API key management, see the **elasticsearch-authn** skill. For roles, users, and role\nmappings, see the **elasticsearch-authz** skill. For license management, see the **elasticsearch-license** skill.\n\nFor diagnostic API endpoints, see [references\u002Fapi-reference.md](references\u002Fapi-reference.md).\n\n> **Deployment note:** Diagnostic API availability differs between self-managed, ECH, and Serverless. See\n> [Deployment Compatibility](#deployment-compatibility) for details.\n\n## Jobs to Be Done\n\n- Diagnose HTTP 401 authentication failures\n- Diagnose HTTP 403 permission denied errors\n- Troubleshoot TLS\u002FSSL handshake or certificate errors\n- Investigate expired or invalid API keys\n- Debug role mappings that do not grant expected roles\n- Fix Kibana login failures, redirect loops, or CORS errors\n- Recover from a license-expiry lockout\n- Determine why a user lacks access to a specific index\n\n## Prerequisites\n\n| Item                   | Description                                                                |\n| ---------------------- | -------------------------------------------------------------------------- |\n| **Elasticsearch URL**  | Cluster endpoint (e.g. `https:\u002F\u002Flocalhost:9200` or a Cloud deployment URL) |\n| **Authentication**     | Any valid credentials — even minimal — to reach the cluster                |\n| **Cluster privileges** | `monitor` for read-only diagnostics; `manage_security` for fixes           |\n\nPrompt the user for any missing values. If the user cannot authenticate at all, start with\n[TLS and Certificate Errors](#tls-and-certificate-errors) or [License Expiry Recovery](#license-expiry-recovery).\n\n## Diagnostic Workflow\n\nRoute the symptom to the correct section:\n\n| Symptom                                        | Section                                                       |\n| ---------------------------------------------- | ------------------------------------------------------------- |\n| HTTP 401, `authentication_exception`           | [Authentication Failures](#authentication-failures-401)       |\n| HTTP 403, `security_exception`, access denied  | [Authorization Failures](#authorization-failures-403)         |\n| SSL\u002FTLS handshake error, certificate rejected  | [TLS and Certificate Errors](#tls-and-certificate-errors)     |\n| API key rejected, expired, or ineffective      | [API Key Issues](#api-key-issues)                             |\n| Role mapping not granting expected roles       | [Role Mapping Issues](#role-mapping-issues)                   |\n| Kibana login broken, redirect loop, CORS error | [Kibana Authentication Issues](#kibana-authentication-issues) |\n| All users locked out, paid features disabled   | [License Expiry Recovery](#license-expiry-recovery)           |\n\nEach section follows a **Gather - Diagnose - Resolve** pattern.\n\n## Diagnostic Toolkit\n\nUse these APIs at the start of any security investigation:\n\n```bash\ncurl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\nConfirms identity, realm, and roles. If this fails with 401, the problem is authentication.\n\n```bash\ncurl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_xpack\"\n```\n\nConfirms whether security is enabled (`features.security.enabled`). If security is disabled, all security APIs return\nerrors.\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F_has_privileges\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"index\": [\n      { \"names\": [\"'\"${INDEX_PATTERN}\"'\"], \"privileges\": [\"read\"] }\n    ]\n  }'\n```\n\nTests whether the authenticated user holds specific privileges without requiring `manage_security`.\n\n```bash\ncurl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_license\"\n```\n\nCheck license type and status. An expired paid license disables paid realms and features.\n\n## Authentication Failures (401)\n\nA 401 response means Elasticsearch could not verify the caller's identity.\n\n### Gather\n\n```bash\ncurl -v \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\" 2>&1\n```\n\nThe `-v` flag shows headers and the response body. Look for:\n\n- `WWW-Authenticate` header — indicates which auth schemes the cluster accepts.\n- `authentication_exception` in the response body — the `reason` field describes what failed.\n\n### Diagnose\n\n| Symptom                                            | Likely cause                                    |\n| -------------------------------------------------- | ----------------------------------------------- |\n| `unable to authenticate user`                      | Wrong username or password                      |\n| `unable to authenticate with provided credentials` | Credentials do not match any realm in the chain |\n| `user is not enabled`                              | The native user account is disabled             |\n| `token is expired`                                 | API key or bearer token has expired             |\n| No `WWW-Authenticate` header                       | Security may be disabled; check `GET \u002F_xpack`   |\n\nIf the user authenticates via an external realm (LDAP, AD, SAML, OIDC), the realm chain order matters. Elasticsearch\ntries realms in configured order and stops at the first match. If a higher-priority realm rejects the credentials before\nthe intended realm is reached, authentication fails.\n\n### Resolve\n\n| Cause                   | Action                                                                     |\n| ----------------------- | -------------------------------------------------------------------------- |\n| Wrong credentials       | Verify username\u002Fpassword or API key value. See **elasticsearch-authn**.    |\n| Disabled user           | `PUT \u002F_security\u002Fuser\u002F{name}\u002F_enable`. See **elasticsearch-authz**.         |\n| Expired API key         | Create a new API key. See [API Key Issues](#api-key-issues).               |\n| Realm chain order       | Check `elasticsearch.yml` realm order (self-managed only).                 |\n| Security disabled       | Enable `xpack.security.enabled: true` in `elasticsearch.yml` and restart.  |\n| Paid realm after expiry | License expired — see [License Expiry Recovery](#license-expiry-recovery). |\n\n## Authorization Failures (403)\n\nA 403 response means the user is authenticated but lacks the required privileges.\n\n### Gather\n\nTest the specific privileges the operation requires:\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F_has_privileges\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"index\": [\n      { \"names\": [\"logs-*\"], \"privileges\": [\"read\", \"view_index_metadata\"] }\n    ],\n    \"cluster\": [\"monitor\"]\n  }'\n```\n\nThe response contains a `has_all_requested` boolean and per-resource breakdowns.\n\nAlso check the user's effective roles:\n\n```bash\ncurl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\nInspect the `roles` array and `authentication_realm` to confirm the user is who you expect.\n\n### Diagnose\n\n| Symptom                                   | Likely cause                                           |\n| ----------------------------------------- | ------------------------------------------------------ |\n| `has_all_requested: false` for an index   | Role is missing the required index privilege           |\n| `has_all_requested: false` for a cluster  | Role is missing the required cluster privilege         |\n| User has fewer roles than expected        | Roles array was replaced (not merged) on last update   |\n| API key returns 403 on previously allowed | API key privileges are a snapshot — role changes after |\n| operation                                 | creation do not propagate to existing keys             |\n\n### Resolve\n\n| Cause                     | Action                                                                                   |\n| ------------------------- | ---------------------------------------------------------------------------------------- |\n| Missing index privilege   | Add the privilege to the role or create a new role. See **elasticsearch-authz**.         |\n| Missing cluster privilege | Add the cluster privilege. See **elasticsearch-authz**.                                  |\n| Roles replaced on update  | Fetch current roles first, then update with the full array. See **elasticsearch-authz**. |\n| Stale API key privileges  | Create a new API key with updated `role_descriptors`. See **elasticsearch-authn**.       |\n\n## TLS and Certificate Errors\n\nTLS errors prevent the client from establishing a connection at all.\n\n### Gather\n\n```bash\ncurl -v --cacert \"${CA_CERT}\" \"https:\u002F\u002F${ELASTICSEARCH_HOST}:9200\u002F\" 2>&1 | head -30\n```\n\nLook for:\n\n- `SSL certificate problem: unable to get local issuer certificate` — CA not trusted.\n- `SSL certificate problem: certificate has expired` — certificate past its validity date.\n- `SSL: no alternative certificate subject name matches target host name` — hostname mismatch.\n\nFor deeper inspection (self-managed only):\n\n```bash\nopenssl s_client -connect \"${ELASTICSEARCH_HOST}:9200\" -showcerts \u003C\u002Fdev\u002Fnull 2>&1\n```\n\nThis displays the full certificate chain, expiry dates, and subject alternative names.\n\n### Diagnose\n\n| Error message                                     | Likely cause                                  |\n| ------------------------------------------------- | --------------------------------------------- |\n| `unable to get local issuer certificate`          | Missing or wrong CA certificate               |\n| `certificate has expired`                         | Server or CA certificate past expiry          |\n| `no alternative certificate subject name matches` | Certificate SAN does not include the hostname |\n| `self-signed certificate`                         | Self-signed cert not in the trust store       |\n| `SSLHandshakeException` (Java client)             | Truststore missing the CA or wrong password   |\n\n### Resolve\n\n| Cause               | Action                                                                     |\n| ------------------- | -------------------------------------------------------------------------- |\n| Wrong CA cert       | Pass the correct CA with `--cacert` or add it to the system trust store.   |\n| Expired certificate | Regenerate certificates with `elasticsearch-certutil` (self-managed).      |\n| Hostname mismatch   | Regenerate the certificate with the correct SAN entries.                   |\n| Self-signed cert    | Distribute the CA cert to all clients or use a publicly trusted CA.        |\n| Quick workaround    | Use `curl -k` \u002F `--insecure` to skip verification. **Not for production.** |\n\nOn ECH, TLS is managed by Elastic — certificate errors usually indicate the client is not using the correct Cloud\nendpoint URL. On Serverless, TLS is fully managed and transparent.\n\n## API Key Issues\n\n### Gather\n\nRetrieve the key's metadata:\n\n```bash\ncurl \"${ELASTICSEARCH_URL}\u002F_security\u002Fapi_key?name=${KEY_NAME}\" \u003Cauth_flags>\n```\n\nCheck `expiration`, `invalidated`, and `role_descriptors` in the response.\n\n### Diagnose\n\n| Symptom                                   | Likely cause                                                     |\n| ----------------------------------------- | ---------------------------------------------------------------- |\n| 401 when using the key                    | Key expired or invalidated                                       |\n| 403 on operations that should be allowed  | Key was created with insufficient `role_descriptors`             |\n| Derived key has no access                 | API key created another API key — derived keys have no privilege |\n| Key works for some indices but not others | `role_descriptors` scope is too narrow                           |\n\n### Resolve\n\n| Cause               | Action                                                                                          |\n| ------------------- | ----------------------------------------------------------------------------------------------- |\n| Expired key         | Create a new key with appropriate `expiration`. See **elasticsearch-authn**.                    |\n| Invalidated key     | Create a new key. Invalidated keys cannot be reinstated.                                        |\n| Wrong scope         | Create a new key with correct `role_descriptors`. See **elasticsearch-authn**.                  |\n| Derived key problem | Use `POST \u002F_security\u002Fapi_key\u002Fgrant` with user credentials instead. See **elasticsearch-authn**. |\n\n## Role Mapping Issues\n\nRole mappings grant roles to users from external realms. When they fail silently, users authenticate but get no roles.\n\n### Gather\n\n```bash\ncurl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\nNote the `username`, `authentication_realm.name`, and `roles` array.\n\n```bash\ncurl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\"\n```\n\nList all mappings and inspect their `rules` and `enabled` fields.\n\n### Diagnose\n\n| Symptom                                    | Likely cause                                               |\n| ------------------------------------------ | ---------------------------------------------------------- |\n| User has empty `roles` array               | No mapping matches the user's attributes                   |\n| User gets wrong roles                      | A different mapping matched first or the rule is too broad |\n| Mapping exists but does not apply          | `enabled` is `false`                                       |\n| Mustache template produces wrong role name | Template syntax error or unexpected attribute value        |\n\nCompare the user's `authentication_realm.name` and `groups` (from `_authenticate`) against each mapping's `rules` to\nfind the mismatch.\n\n### Resolve\n\n| Cause            | Action                                                                               |\n| ---------------- | ------------------------------------------------------------------------------------ |\n| No matching rule | Update the mapping rules to match the user's realm and attributes.                   |\n| Mapping disabled | Set `\"enabled\": true` on the mapping.                                                |\n| Template error   | Test the Mustache template with known attribute values. See **elasticsearch-authz**. |\n| Rule too broad   | Add `all` \u002F `except` conditions to narrow the match. See **elasticsearch-authz**.    |\n\n## Kibana Authentication Issues\n\n### Missing `kbn-xsrf` header\n\nAll mutating Kibana API requests require the `kbn-xsrf` header:\n\n```bash\ncurl -X PUT \"${KIBANA_URL}\u002Fapi\u002Fsecurity\u002Frole\u002Fmy-role\" \\\n  \u003Cauth_flags> \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{ ... }'\n```\n\nWithout it, Kibana returns `400 Bad Request` with `\"Request must contain a kbn-xsrf header\"`.\n\n### SAML\u002FOIDC redirect loop\n\nCommon causes:\n\n- Incorrect `xpack.security.authc.realms.saml.*.sp.acs` or `idp.metadata.path` in `elasticsearch.yml`.\n- Clock skew between the IdP and Elasticsearch nodes (SAML assertions have a validity window).\n- Kibana `server.publicBaseUrl` does not match the SAML ACS URL.\n\nVerify the SAML realm configuration:\n\n```bash\ncurl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\nIf this returns a valid user via a non-SAML realm, the SAML realm itself is not being reached. Check realm chain order.\n\n### Kibana cannot reach Elasticsearch\n\nKibana logs `Unable to retrieve version information from Elasticsearch nodes`. Verify the `elasticsearch.hosts` setting\nin `kibana.yml` points to a reachable endpoint and the credentials (`elasticsearch.username` \u002F `elasticsearch.password`\nor `elasticsearch.serviceAccountToken`) are valid.\n\n## License Expiry Recovery\n\nWhen a paid license expires, the cluster enters a **security-closed** state: paid realms (SAML, LDAP, AD, PKI) stop\nworking and users authenticating through them are locked out. Native and file realms remain functional.\n\n### Quick triage\n\n```bash\ncurl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_license\"\n```\n\nIf `license.status` is `\"expired\"`, proceed with recovery.\n\n### Recovery steps\n\nFollow the detailed recovery workflow in the **elasticsearch-license** skill. The critical first step depends on\ndeployment type:\n\n| Deployment   | First step                                                                |\n| ------------ | ------------------------------------------------------------------------- |\n| Self-managed | Log in with a file-based user (`elasticsearch-users` CLI) or native user. |\n| ECH          | Contact Elastic support or renew via the Cloud console.                   |\n| Serverless   | Not applicable — licensing is fully managed by Elastic.                   |\n\n## Examples\n\n### User gets 403 when querying logs\n\n**Symptom:** \"I get a 403 when searching `logs-*`.\"\n\n1. Verify identity:\n\n```bash\ncurl -u \"joe:${PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\nResponse shows `\"roles\": [\"viewer\"]`.\n\n1. Test privileges:\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F_has_privileges\" \\\n  -u \"joe:${PASSWORD}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"index\": [{\"names\": [\"logs-*\"], \"privileges\": [\"read\"]}]}'\n```\n\nResponse: `\"has_all_requested\": false` — the `viewer` role does not include `read` on `logs-*`.\n\n1. Fix: create a `logs-reader` role and assign it to Joe. See **elasticsearch-authz**.\n\n### API key stopped working\n\n**Symptom:** \"My API key returns 401 since yesterday.\"\n\n1. Check the key:\n\n```bash\ncurl -u \"admin:${PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002Fapi_key?name=my-key\"\n```\n\nResponse shows `\"expiration\": 1709251200000` — the key expired.\n\n1. Fix: create a new API key with a suitable `expiration`. See **elasticsearch-authn**.\n\n### SAML login redirects to error\n\n**Symptom:** \"Clicking the SSO button in Kibana redirects to an error page.\"\n\n1. Check if the SAML realm is reachable by authenticating with a non-SAML method:\n\n```bash\ncurl -u \"elastic:${PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n```\n\n1. Verify the IdP metadata URL is accessible from the Elasticsearch nodes (self-managed):\n\n```bash\ncurl -s \"${IDP_METADATA_URL}\" | head -5\n```\n\n1. Check for clock skew — SAML assertions are time-sensitive. Ensure NTP is configured on all nodes.\n1. Verify `server.publicBaseUrl` in `kibana.yml` matches the SAML ACS URL configured in the IdP.\n\n### Users locked out after license expired\n\n**Symptom:** \"Nobody can log in to Kibana. We use SAML.\"\n\n1. Check license:\n\n```bash\ncurl -u \"admin:${PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_license\"\n```\n\nResponse shows `\"status\": \"expired\"`, `\"type\": \"platinum\"`.\n\n1. The SAML realm is disabled because the paid license expired. Follow the recovery steps in **elasticsearch-license**:\n   log in with a file-based or native user, then upload a renewed license or revert to basic.\n\n## Guidelines\n\n### Always start with `_authenticate`\n\nRun `GET \u002F_security\u002F_authenticate` as the first diagnostic step. It reveals the user's identity, realm, roles, and\nauthentication type in a single call. Most issues become apparent from this response alone.\n\n### Check the license early\n\nBefore investigating realm or privilege issues, verify the license is active with `GET \u002F_license`. An expired paid\nlicense disables realms and features, producing symptoms that mimic misconfiguration.\n\n### Use `_has_privileges` before manual inspection\n\nInstead of reading role definitions and mentally computing effective access, use `POST \u002F_security\u002Fuser\u002F_has_privileges`\nto test specific privileges directly. This is faster and accounts for role composition, DLS, and FLS.\n\n### Avoid superuser credentials\n\nNever use the built-in `elastic` superuser for day-to-day troubleshooting. Create a dedicated admin user or API key with\n`manage_security` privileges. Reserve the `elastic` user for initial setup and emergency recovery only.\n\n### Do not bypass TLS in production\n\nUsing `curl -k` or `--insecure` skips certificate verification and masks real TLS issues. Use it only for initial\ndiagnosis, then fix the underlying certificate problem.\n\n## Deployment Compatibility\n\nDiagnostic tool and API availability differs across deployment types.\n\n| Tool \u002F API                       | Self-managed | ECH           | Serverless    |\n| -------------------------------- | ------------ | ------------- | ------------- |\n| `_security\u002F_authenticate`        | Yes          | Yes           | Yes           |\n| `_security\u002Fuser\u002F_has_privileges` | Yes          | Yes           | Yes           |\n| `_xpack`                         | Yes          | Yes           | Limited       |\n| `_license`                       | Yes          | Yes (read)    | Not available |\n| `_security\u002Fapi_key` (GET)        | Yes          | Yes           | Yes           |\n| `_security\u002Frole_mapping`         | Yes          | Yes           | Yes           |\n| `elasticsearch-users` CLI        | Yes          | Not available | Not available |\n| `openssl s_client` on nodes      | Yes          | Not available | Not available |\n| Elasticsearch logs               | Yes          | Via Cloud UI  | Via Cloud UI  |\n\n**ECH notes:**\n\n- No node-level access, so the `elasticsearch-users` CLI and direct log\u002Fcertificate inspection are not available.\n- TLS is managed by Elastic — certificate errors typically indicate an incorrect endpoint URL.\n- Use the Cloud console for log inspection and deployment configuration.\n\n**Serverless notes:**\n\n- Licensing APIs are not exposed. License-related lockouts do not occur.\n- Native users do not exist — authentication issues are handled at the organization level.\n- TLS is fully managed and transparent.\n",{"data":35,"body":38},{"name":4,"description":6,"metadata":36},{"author":8,"version":37},"0.1.0",{"type":39,"children":40},"root",[41,49,55,82,95,117,124,169,175,274,294,300,305,456,468,474,479,550,555,606,619,802,813,864,869,875,880,887,947,960,992,998,1113,1118,1124,1273,1279,1284,1289,1294,1444,1457,1462,1511,1532,1537,1633,1638,1737,1742,1747,1752,1841,1846,1882,1887,1951,1956,1961,2069,2074,2196,2201,2206,2211,2216,2277,2304,2309,2391,2396,2502,2507,2512,2517,2566,2592,2643,2664,2669,2759,2793,2798,2903,2908,2921,2933,3072,3092,3098,3103,3149,3154,3203,3208,3214,3266,3271,3283,3289,3338,3358,3364,3375,3444,3450,3456,3474,3483,3544,3556,3564,3685,3720,3741,3747,3756,3764,3824,3836,3855,3861,3870,3878,3937,3945,3990,4016,4022,4031,4039,4097,4115,4129,4135,4146,4159,4165,4178,4191,4204,4210,4236,4242,4260,4265,4270,4521,4529,4554,4562,4580],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":48},"text","Elasticsearch Security Troubleshooting",{"type":42,"tag":50,"props":51,"children":52},"p",{},[53],{"type":47,"value":54},"Diagnose and resolve common Elasticsearch security issues. This skill provides a structured triage workflow for\nauthentication failures, authorization errors, TLS problems, API key issues, role mapping mismatches, Kibana login\nfailures, and license-expiry lockouts.",{"type":42,"tag":50,"props":56,"children":57},{},[58,60,66,68,73,75,80],{"type":47,"value":59},"For authentication methods and API key management, see the ",{"type":42,"tag":61,"props":62,"children":63},"strong",{},[64],{"type":47,"value":65},"elasticsearch-authn",{"type":47,"value":67}," skill. For roles, users, and role\nmappings, see the ",{"type":42,"tag":61,"props":69,"children":70},{},[71],{"type":47,"value":72},"elasticsearch-authz",{"type":47,"value":74}," skill. For license management, see the ",{"type":42,"tag":61,"props":76,"children":77},{},[78],{"type":47,"value":79},"elasticsearch-license",{"type":47,"value":81}," skill.",{"type":42,"tag":50,"props":83,"children":84},{},[85,87,93],{"type":47,"value":86},"For diagnostic API endpoints, see ",{"type":42,"tag":88,"props":89,"children":91},"a",{"href":90},"references\u002Fapi-reference.md",[92],{"type":47,"value":90},{"type":47,"value":94},".",{"type":42,"tag":96,"props":97,"children":98},"blockquote",{},[99],{"type":42,"tag":50,"props":100,"children":101},{},[102,107,109,115],{"type":42,"tag":61,"props":103,"children":104},{},[105],{"type":47,"value":106},"Deployment note:",{"type":47,"value":108}," Diagnostic API availability differs between self-managed, ECH, and Serverless. See\n",{"type":42,"tag":88,"props":110,"children":112},{"href":111},"#deployment-compatibility",[113],{"type":47,"value":114},"Deployment Compatibility",{"type":47,"value":116}," for details.",{"type":42,"tag":118,"props":119,"children":121},"h2",{"id":120},"jobs-to-be-done",[122],{"type":47,"value":123},"Jobs to Be Done",{"type":42,"tag":125,"props":126,"children":127},"ul",{},[128,134,139,144,149,154,159,164],{"type":42,"tag":129,"props":130,"children":131},"li",{},[132],{"type":47,"value":133},"Diagnose HTTP 401 authentication failures",{"type":42,"tag":129,"props":135,"children":136},{},[137],{"type":47,"value":138},"Diagnose HTTP 403 permission denied errors",{"type":42,"tag":129,"props":140,"children":141},{},[142],{"type":47,"value":143},"Troubleshoot TLS\u002FSSL handshake or certificate errors",{"type":42,"tag":129,"props":145,"children":146},{},[147],{"type":47,"value":148},"Investigate expired or invalid API keys",{"type":42,"tag":129,"props":150,"children":151},{},[152],{"type":47,"value":153},"Debug role mappings that do not grant expected roles",{"type":42,"tag":129,"props":155,"children":156},{},[157],{"type":47,"value":158},"Fix Kibana login failures, redirect loops, or CORS errors",{"type":42,"tag":129,"props":160,"children":161},{},[162],{"type":47,"value":163},"Recover from a license-expiry lockout",{"type":42,"tag":129,"props":165,"children":166},{},[167],{"type":47,"value":168},"Determine why a user lacks access to a specific index",{"type":42,"tag":118,"props":170,"children":172},{"id":171},"prerequisites",[173],{"type":47,"value":174},"Prerequisites",{"type":42,"tag":176,"props":177,"children":178},"table",{},[179,198],{"type":42,"tag":180,"props":181,"children":182},"thead",{},[183],{"type":42,"tag":184,"props":185,"children":186},"tr",{},[187,193],{"type":42,"tag":188,"props":189,"children":190},"th",{},[191],{"type":47,"value":192},"Item",{"type":42,"tag":188,"props":194,"children":195},{},[196],{"type":47,"value":197},"Description",{"type":42,"tag":199,"props":200,"children":201},"tbody",{},[202,228,244],{"type":42,"tag":184,"props":203,"children":204},{},[205,214],{"type":42,"tag":206,"props":207,"children":208},"td",{},[209],{"type":42,"tag":61,"props":210,"children":211},{},[212],{"type":47,"value":213},"Elasticsearch URL",{"type":42,"tag":206,"props":215,"children":216},{},[217,219,226],{"type":47,"value":218},"Cluster endpoint (e.g. ",{"type":42,"tag":220,"props":221,"children":223},"code",{"className":222},[],[224],{"type":47,"value":225},"https:\u002F\u002Flocalhost:9200",{"type":47,"value":227}," or a Cloud deployment URL)",{"type":42,"tag":184,"props":229,"children":230},{},[231,239],{"type":42,"tag":206,"props":232,"children":233},{},[234],{"type":42,"tag":61,"props":235,"children":236},{},[237],{"type":47,"value":238},"Authentication",{"type":42,"tag":206,"props":240,"children":241},{},[242],{"type":47,"value":243},"Any valid credentials — even minimal — to reach the cluster",{"type":42,"tag":184,"props":245,"children":246},{},[247,255],{"type":42,"tag":206,"props":248,"children":249},{},[250],{"type":42,"tag":61,"props":251,"children":252},{},[253],{"type":47,"value":254},"Cluster privileges",{"type":42,"tag":206,"props":256,"children":257},{},[258,264,266,272],{"type":42,"tag":220,"props":259,"children":261},{"className":260},[],[262],{"type":47,"value":263},"monitor",{"type":47,"value":265}," for read-only diagnostics; ",{"type":42,"tag":220,"props":267,"children":269},{"className":268},[],[270],{"type":47,"value":271},"manage_security",{"type":47,"value":273}," for fixes",{"type":42,"tag":50,"props":275,"children":276},{},[277,279,285,287,293],{"type":47,"value":278},"Prompt the user for any missing values. If the user cannot authenticate at all, start with\n",{"type":42,"tag":88,"props":280,"children":282},{"href":281},"#tls-and-certificate-errors",[283],{"type":47,"value":284},"TLS and Certificate Errors",{"type":47,"value":286}," or ",{"type":42,"tag":88,"props":288,"children":290},{"href":289},"#license-expiry-recovery",[291],{"type":47,"value":292},"License Expiry Recovery",{"type":47,"value":94},{"type":42,"tag":118,"props":295,"children":297},{"id":296},"diagnostic-workflow",[298],{"type":47,"value":299},"Diagnostic Workflow",{"type":42,"tag":50,"props":301,"children":302},{},[303],{"type":47,"value":304},"Route the symptom to the correct section:",{"type":42,"tag":176,"props":306,"children":307},{},[308,324],{"type":42,"tag":180,"props":309,"children":310},{},[311],{"type":42,"tag":184,"props":312,"children":313},{},[314,319],{"type":42,"tag":188,"props":315,"children":316},{},[317],{"type":47,"value":318},"Symptom",{"type":42,"tag":188,"props":320,"children":321},{},[322],{"type":47,"value":323},"Section",{"type":42,"tag":199,"props":325,"children":326},{},[327,350,375,390,407,424,441],{"type":42,"tag":184,"props":328,"children":329},{},[330,341],{"type":42,"tag":206,"props":331,"children":332},{},[333,335],{"type":47,"value":334},"HTTP 401, ",{"type":42,"tag":220,"props":336,"children":338},{"className":337},[],[339],{"type":47,"value":340},"authentication_exception",{"type":42,"tag":206,"props":342,"children":343},{},[344],{"type":42,"tag":88,"props":345,"children":347},{"href":346},"#authentication-failures-401",[348],{"type":47,"value":349},"Authentication Failures",{"type":42,"tag":184,"props":351,"children":352},{},[353,366],{"type":42,"tag":206,"props":354,"children":355},{},[356,358,364],{"type":47,"value":357},"HTTP 403, ",{"type":42,"tag":220,"props":359,"children":361},{"className":360},[],[362],{"type":47,"value":363},"security_exception",{"type":47,"value":365},", access denied",{"type":42,"tag":206,"props":367,"children":368},{},[369],{"type":42,"tag":88,"props":370,"children":372},{"href":371},"#authorization-failures-403",[373],{"type":47,"value":374},"Authorization Failures",{"type":42,"tag":184,"props":376,"children":377},{},[378,383],{"type":42,"tag":206,"props":379,"children":380},{},[381],{"type":47,"value":382},"SSL\u002FTLS handshake error, certificate rejected",{"type":42,"tag":206,"props":384,"children":385},{},[386],{"type":42,"tag":88,"props":387,"children":388},{"href":281},[389],{"type":47,"value":284},{"type":42,"tag":184,"props":391,"children":392},{},[393,398],{"type":42,"tag":206,"props":394,"children":395},{},[396],{"type":47,"value":397},"API key rejected, expired, or ineffective",{"type":42,"tag":206,"props":399,"children":400},{},[401],{"type":42,"tag":88,"props":402,"children":404},{"href":403},"#api-key-issues",[405],{"type":47,"value":406},"API Key Issues",{"type":42,"tag":184,"props":408,"children":409},{},[410,415],{"type":42,"tag":206,"props":411,"children":412},{},[413],{"type":47,"value":414},"Role mapping not granting expected roles",{"type":42,"tag":206,"props":416,"children":417},{},[418],{"type":42,"tag":88,"props":419,"children":421},{"href":420},"#role-mapping-issues",[422],{"type":47,"value":423},"Role Mapping Issues",{"type":42,"tag":184,"props":425,"children":426},{},[427,432],{"type":42,"tag":206,"props":428,"children":429},{},[430],{"type":47,"value":431},"Kibana login broken, redirect loop, CORS error",{"type":42,"tag":206,"props":433,"children":434},{},[435],{"type":42,"tag":88,"props":436,"children":438},{"href":437},"#kibana-authentication-issues",[439],{"type":47,"value":440},"Kibana Authentication Issues",{"type":42,"tag":184,"props":442,"children":443},{},[444,449],{"type":42,"tag":206,"props":445,"children":446},{},[447],{"type":47,"value":448},"All users locked out, paid features disabled",{"type":42,"tag":206,"props":450,"children":451},{},[452],{"type":42,"tag":88,"props":453,"children":454},{"href":289},[455],{"type":47,"value":292},{"type":42,"tag":50,"props":457,"children":458},{},[459,461,466],{"type":47,"value":460},"Each section follows a ",{"type":42,"tag":61,"props":462,"children":463},{},[464],{"type":47,"value":465},"Gather - Diagnose - Resolve",{"type":47,"value":467}," pattern.",{"type":42,"tag":118,"props":469,"children":471},{"id":470},"diagnostic-toolkit",[472],{"type":47,"value":473},"Diagnostic Toolkit",{"type":42,"tag":50,"props":475,"children":476},{},[477],{"type":47,"value":478},"Use these APIs at the start of any security investigation:",{"type":42,"tag":480,"props":481,"children":486},"pre",{"className":482,"code":483,"language":484,"meta":485,"style":485},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n","bash","",[487],{"type":42,"tag":220,"props":488,"children":489},{"__ignoreMap":485},[490],{"type":42,"tag":491,"props":492,"children":495},"span",{"class":493,"line":494},"line",1,[496,502,508,514,520,525,530,535,540,545],{"type":42,"tag":491,"props":497,"children":499},{"style":498},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[500],{"type":47,"value":501},"curl",{"type":42,"tag":491,"props":503,"children":505},{"style":504},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[506],{"type":47,"value":507}," \u003C",{"type":42,"tag":491,"props":509,"children":511},{"style":510},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[512],{"type":47,"value":513},"auth_flag",{"type":42,"tag":491,"props":515,"children":517},{"style":516},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[518],{"type":47,"value":519},"s",{"type":42,"tag":491,"props":521,"children":522},{"style":504},[523],{"type":47,"value":524},">",{"type":42,"tag":491,"props":526,"children":527},{"style":504},[528],{"type":47,"value":529}," \"${",{"type":42,"tag":491,"props":531,"children":532},{"style":516},[533],{"type":47,"value":534},"ELASTICSEARCH_URL",{"type":42,"tag":491,"props":536,"children":537},{"style":504},[538],{"type":47,"value":539},"}",{"type":42,"tag":491,"props":541,"children":542},{"style":510},[543],{"type":47,"value":544},"\u002F_security\u002F_authenticate",{"type":42,"tag":491,"props":546,"children":547},{"style":504},[548],{"type":47,"value":549},"\"\n",{"type":42,"tag":50,"props":551,"children":552},{},[553],{"type":47,"value":554},"Confirms identity, realm, and roles. If this fails with 401, the problem is authentication.",{"type":42,"tag":480,"props":556,"children":558},{"className":482,"code":557,"language":484,"meta":485,"style":485},"curl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_xpack\"\n",[559],{"type":42,"tag":220,"props":560,"children":561},{"__ignoreMap":485},[562],{"type":42,"tag":491,"props":563,"children":564},{"class":493,"line":494},[565,569,573,577,581,585,589,593,597,602],{"type":42,"tag":491,"props":566,"children":567},{"style":498},[568],{"type":47,"value":501},{"type":42,"tag":491,"props":570,"children":571},{"style":504},[572],{"type":47,"value":507},{"type":42,"tag":491,"props":574,"children":575},{"style":510},[576],{"type":47,"value":513},{"type":42,"tag":491,"props":578,"children":579},{"style":516},[580],{"type":47,"value":519},{"type":42,"tag":491,"props":582,"children":583},{"style":504},[584],{"type":47,"value":524},{"type":42,"tag":491,"props":586,"children":587},{"style":504},[588],{"type":47,"value":529},{"type":42,"tag":491,"props":590,"children":591},{"style":516},[592],{"type":47,"value":534},{"type":42,"tag":491,"props":594,"children":595},{"style":504},[596],{"type":47,"value":539},{"type":42,"tag":491,"props":598,"children":599},{"style":510},[600],{"type":47,"value":601},"\u002F_xpack",{"type":42,"tag":491,"props":603,"children":604},{"style":504},[605],{"type":47,"value":549},{"type":42,"tag":50,"props":607,"children":608},{},[609,611,617],{"type":47,"value":610},"Confirms whether security is enabled (",{"type":42,"tag":220,"props":612,"children":614},{"className":613},[],[615],{"type":47,"value":616},"features.security.enabled",{"type":47,"value":618},"). If security is disabled, all security APIs return\nerrors.",{"type":42,"tag":480,"props":620,"children":622},{"className":482,"code":621,"language":484,"meta":485,"style":485},"curl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F_has_privileges\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"index\": [\n      { \"names\": [\"'\"${INDEX_PATTERN}\"'\"], \"privileges\": [\"read\"] }\n    ]\n  }'\n",[623],{"type":42,"tag":220,"props":624,"children":625},{"__ignoreMap":485},[626,670,695,722,741,750,779,788],{"type":42,"tag":491,"props":627,"children":628},{"class":493,"line":494},[629,633,638,643,647,651,655,660,665],{"type":42,"tag":491,"props":630,"children":631},{"style":498},[632],{"type":47,"value":501},{"type":42,"tag":491,"props":634,"children":635},{"style":510},[636],{"type":47,"value":637}," -X",{"type":42,"tag":491,"props":639,"children":640},{"style":510},[641],{"type":47,"value":642}," POST",{"type":42,"tag":491,"props":644,"children":645},{"style":504},[646],{"type":47,"value":529},{"type":42,"tag":491,"props":648,"children":649},{"style":516},[650],{"type":47,"value":534},{"type":42,"tag":491,"props":652,"children":653},{"style":504},[654],{"type":47,"value":539},{"type":42,"tag":491,"props":656,"children":657},{"style":510},[658],{"type":47,"value":659},"\u002F_security\u002Fuser\u002F_has_privileges",{"type":42,"tag":491,"props":661,"children":662},{"style":504},[663],{"type":47,"value":664},"\"",{"type":42,"tag":491,"props":666,"children":667},{"style":516},[668],{"type":47,"value":669}," \\\n",{"type":42,"tag":491,"props":671,"children":673},{"class":493,"line":672},2,[674,679,683,687,691],{"type":42,"tag":491,"props":675,"children":676},{"style":504},[677],{"type":47,"value":678},"  \u003C",{"type":42,"tag":491,"props":680,"children":681},{"style":510},[682],{"type":47,"value":513},{"type":42,"tag":491,"props":684,"children":685},{"style":516},[686],{"type":47,"value":519},{"type":42,"tag":491,"props":688,"children":689},{"style":504},[690],{"type":47,"value":524},{"type":42,"tag":491,"props":692,"children":693},{"style":516},[694],{"type":47,"value":669},{"type":42,"tag":491,"props":696,"children":698},{"class":493,"line":697},3,[699,704,709,714,718],{"type":42,"tag":491,"props":700,"children":701},{"style":510},[702],{"type":47,"value":703},"  -H",{"type":42,"tag":491,"props":705,"children":706},{"style":504},[707],{"type":47,"value":708}," \"",{"type":42,"tag":491,"props":710,"children":711},{"style":510},[712],{"type":47,"value":713},"Content-Type: application\u002Fjson",{"type":42,"tag":491,"props":715,"children":716},{"style":504},[717],{"type":47,"value":664},{"type":42,"tag":491,"props":719,"children":720},{"style":516},[721],{"type":47,"value":669},{"type":42,"tag":491,"props":723,"children":725},{"class":493,"line":724},4,[726,731,736],{"type":42,"tag":491,"props":727,"children":728},{"style":510},[729],{"type":47,"value":730},"  -d",{"type":42,"tag":491,"props":732,"children":733},{"style":504},[734],{"type":47,"value":735}," '",{"type":42,"tag":491,"props":737,"children":738},{"style":510},[739],{"type":47,"value":740},"{\n",{"type":42,"tag":491,"props":742,"children":744},{"class":493,"line":743},5,[745],{"type":42,"tag":491,"props":746,"children":747},{"style":510},[748],{"type":47,"value":749},"    \"index\": [\n",{"type":42,"tag":491,"props":751,"children":753},{"class":493,"line":752},6,[754,759,764,769,774],{"type":42,"tag":491,"props":755,"children":756},{"style":510},[757],{"type":47,"value":758},"      { \"names\": [\"",{"type":42,"tag":491,"props":760,"children":761},{"style":504},[762],{"type":47,"value":763},"'\"${",{"type":42,"tag":491,"props":765,"children":766},{"style":516},[767],{"type":47,"value":768},"INDEX_PATTERN",{"type":42,"tag":491,"props":770,"children":771},{"style":504},[772],{"type":47,"value":773},"}\"'",{"type":42,"tag":491,"props":775,"children":776},{"style":510},[777],{"type":47,"value":778},"\"], \"privileges\": [\"read\"] }\n",{"type":42,"tag":491,"props":780,"children":782},{"class":493,"line":781},7,[783],{"type":42,"tag":491,"props":784,"children":785},{"style":510},[786],{"type":47,"value":787},"    ]\n",{"type":42,"tag":491,"props":789,"children":791},{"class":493,"line":790},8,[792,797],{"type":42,"tag":491,"props":793,"children":794},{"style":510},[795],{"type":47,"value":796},"  }",{"type":42,"tag":491,"props":798,"children":799},{"style":504},[800],{"type":47,"value":801},"'\n",{"type":42,"tag":50,"props":803,"children":804},{},[805,807,812],{"type":47,"value":806},"Tests whether the authenticated user holds specific privileges without requiring ",{"type":42,"tag":220,"props":808,"children":810},{"className":809},[],[811],{"type":47,"value":271},{"type":47,"value":94},{"type":42,"tag":480,"props":814,"children":816},{"className":482,"code":815,"language":484,"meta":485,"style":485},"curl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_license\"\n",[817],{"type":42,"tag":220,"props":818,"children":819},{"__ignoreMap":485},[820],{"type":42,"tag":491,"props":821,"children":822},{"class":493,"line":494},[823,827,831,835,839,843,847,851,855,860],{"type":42,"tag":491,"props":824,"children":825},{"style":498},[826],{"type":47,"value":501},{"type":42,"tag":491,"props":828,"children":829},{"style":504},[830],{"type":47,"value":507},{"type":42,"tag":491,"props":832,"children":833},{"style":510},[834],{"type":47,"value":513},{"type":42,"tag":491,"props":836,"children":837},{"style":516},[838],{"type":47,"value":519},{"type":42,"tag":491,"props":840,"children":841},{"style":504},[842],{"type":47,"value":524},{"type":42,"tag":491,"props":844,"children":845},{"style":504},[846],{"type":47,"value":529},{"type":42,"tag":491,"props":848,"children":849},{"style":516},[850],{"type":47,"value":534},{"type":42,"tag":491,"props":852,"children":853},{"style":504},[854],{"type":47,"value":539},{"type":42,"tag":491,"props":856,"children":857},{"style":510},[858],{"type":47,"value":859},"\u002F_license",{"type":42,"tag":491,"props":861,"children":862},{"style":504},[863],{"type":47,"value":549},{"type":42,"tag":50,"props":865,"children":866},{},[867],{"type":47,"value":868},"Check license type and status. An expired paid license disables paid realms and features.",{"type":42,"tag":118,"props":870,"children":872},{"id":871},"authentication-failures-401",[873],{"type":47,"value":874},"Authentication Failures (401)",{"type":42,"tag":50,"props":876,"children":877},{},[878],{"type":47,"value":879},"A 401 response means Elasticsearch could not verify the caller's identity.",{"type":42,"tag":881,"props":882,"children":884},"h3",{"id":883},"gather",[885],{"type":47,"value":886},"Gather",{"type":42,"tag":480,"props":888,"children":890},{"className":482,"code":889,"language":484,"meta":485,"style":485},"curl -v \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\" 2>&1\n",[891],{"type":42,"tag":220,"props":892,"children":893},{"__ignoreMap":485},[894],{"type":42,"tag":491,"props":895,"children":896},{"class":493,"line":494},[897,901,906,910,914,918,922,926,930,934,938,942],{"type":42,"tag":491,"props":898,"children":899},{"style":498},[900],{"type":47,"value":501},{"type":42,"tag":491,"props":902,"children":903},{"style":510},[904],{"type":47,"value":905}," -v",{"type":42,"tag":491,"props":907,"children":908},{"style":504},[909],{"type":47,"value":507},{"type":42,"tag":491,"props":911,"children":912},{"style":510},[913],{"type":47,"value":513},{"type":42,"tag":491,"props":915,"children":916},{"style":516},[917],{"type":47,"value":519},{"type":42,"tag":491,"props":919,"children":920},{"style":504},[921],{"type":47,"value":524},{"type":42,"tag":491,"props":923,"children":924},{"style":504},[925],{"type":47,"value":529},{"type":42,"tag":491,"props":927,"children":928},{"style":516},[929],{"type":47,"value":534},{"type":42,"tag":491,"props":931,"children":932},{"style":504},[933],{"type":47,"value":539},{"type":42,"tag":491,"props":935,"children":936},{"style":510},[937],{"type":47,"value":544},{"type":42,"tag":491,"props":939,"children":940},{"style":504},[941],{"type":47,"value":664},{"type":42,"tag":491,"props":943,"children":944},{"style":504},[945],{"type":47,"value":946}," 2>&1\n",{"type":42,"tag":50,"props":948,"children":949},{},[950,952,958],{"type":47,"value":951},"The ",{"type":42,"tag":220,"props":953,"children":955},{"className":954},[],[956],{"type":47,"value":957},"-v",{"type":47,"value":959}," flag shows headers and the response body. Look for:",{"type":42,"tag":125,"props":961,"children":962},{},[963,974],{"type":42,"tag":129,"props":964,"children":965},{},[966,972],{"type":42,"tag":220,"props":967,"children":969},{"className":968},[],[970],{"type":47,"value":971},"WWW-Authenticate",{"type":47,"value":973}," header — indicates which auth schemes the cluster accepts.",{"type":42,"tag":129,"props":975,"children":976},{},[977,982,984,990],{"type":42,"tag":220,"props":978,"children":980},{"className":979},[],[981],{"type":47,"value":340},{"type":47,"value":983}," in the response body — the ",{"type":42,"tag":220,"props":985,"children":987},{"className":986},[],[988],{"type":47,"value":989},"reason",{"type":47,"value":991}," field describes what failed.",{"type":42,"tag":881,"props":993,"children":995},{"id":994},"diagnose",[996],{"type":47,"value":997},"Diagnose",{"type":42,"tag":176,"props":999,"children":1000},{},[1001,1016],{"type":42,"tag":180,"props":1002,"children":1003},{},[1004],{"type":42,"tag":184,"props":1005,"children":1006},{},[1007,1011],{"type":42,"tag":188,"props":1008,"children":1009},{},[1010],{"type":47,"value":318},{"type":42,"tag":188,"props":1012,"children":1013},{},[1014],{"type":47,"value":1015},"Likely cause",{"type":42,"tag":199,"props":1017,"children":1018},{},[1019,1036,1053,1070,1087],{"type":42,"tag":184,"props":1020,"children":1021},{},[1022,1031],{"type":42,"tag":206,"props":1023,"children":1024},{},[1025],{"type":42,"tag":220,"props":1026,"children":1028},{"className":1027},[],[1029],{"type":47,"value":1030},"unable to authenticate user",{"type":42,"tag":206,"props":1032,"children":1033},{},[1034],{"type":47,"value":1035},"Wrong username or password",{"type":42,"tag":184,"props":1037,"children":1038},{},[1039,1048],{"type":42,"tag":206,"props":1040,"children":1041},{},[1042],{"type":42,"tag":220,"props":1043,"children":1045},{"className":1044},[],[1046],{"type":47,"value":1047},"unable to authenticate with provided credentials",{"type":42,"tag":206,"props":1049,"children":1050},{},[1051],{"type":47,"value":1052},"Credentials do not match any realm in the chain",{"type":42,"tag":184,"props":1054,"children":1055},{},[1056,1065],{"type":42,"tag":206,"props":1057,"children":1058},{},[1059],{"type":42,"tag":220,"props":1060,"children":1062},{"className":1061},[],[1063],{"type":47,"value":1064},"user is not enabled",{"type":42,"tag":206,"props":1066,"children":1067},{},[1068],{"type":47,"value":1069},"The native user account is disabled",{"type":42,"tag":184,"props":1071,"children":1072},{},[1073,1082],{"type":42,"tag":206,"props":1074,"children":1075},{},[1076],{"type":42,"tag":220,"props":1077,"children":1079},{"className":1078},[],[1080],{"type":47,"value":1081},"token is expired",{"type":42,"tag":206,"props":1083,"children":1084},{},[1085],{"type":47,"value":1086},"API key or bearer token has expired",{"type":42,"tag":184,"props":1088,"children":1089},{},[1090,1102],{"type":42,"tag":206,"props":1091,"children":1092},{},[1093,1095,1100],{"type":47,"value":1094},"No ",{"type":42,"tag":220,"props":1096,"children":1098},{"className":1097},[],[1099],{"type":47,"value":971},{"type":47,"value":1101}," header",{"type":42,"tag":206,"props":1103,"children":1104},{},[1105,1107],{"type":47,"value":1106},"Security may be disabled; check ",{"type":42,"tag":220,"props":1108,"children":1110},{"className":1109},[],[1111],{"type":47,"value":1112},"GET \u002F_xpack",{"type":42,"tag":50,"props":1114,"children":1115},{},[1116],{"type":47,"value":1117},"If the user authenticates via an external realm (LDAP, AD, SAML, OIDC), the realm chain order matters. Elasticsearch\ntries realms in configured order and stops at the first match. If a higher-priority realm rejects the credentials before\nthe intended realm is reached, authentication fails.",{"type":42,"tag":881,"props":1119,"children":1121},{"id":1120},"resolve",[1122],{"type":47,"value":1123},"Resolve",{"type":42,"tag":176,"props":1125,"children":1126},{},[1127,1143],{"type":42,"tag":180,"props":1128,"children":1129},{},[1130],{"type":42,"tag":184,"props":1131,"children":1132},{},[1133,1138],{"type":42,"tag":188,"props":1134,"children":1135},{},[1136],{"type":47,"value":1137},"Cause",{"type":42,"tag":188,"props":1139,"children":1140},{},[1141],{"type":47,"value":1142},"Action",{"type":42,"tag":199,"props":1144,"children":1145},{},[1146,1164,1188,1206,1227,1255],{"type":42,"tag":184,"props":1147,"children":1148},{},[1149,1154],{"type":42,"tag":206,"props":1150,"children":1151},{},[1152],{"type":47,"value":1153},"Wrong credentials",{"type":42,"tag":206,"props":1155,"children":1156},{},[1157,1159,1163],{"type":47,"value":1158},"Verify username\u002Fpassword or API key value. See ",{"type":42,"tag":61,"props":1160,"children":1161},{},[1162],{"type":47,"value":65},{"type":47,"value":94},{"type":42,"tag":184,"props":1165,"children":1166},{},[1167,1172],{"type":42,"tag":206,"props":1168,"children":1169},{},[1170],{"type":47,"value":1171},"Disabled user",{"type":42,"tag":206,"props":1173,"children":1174},{},[1175,1181,1183,1187],{"type":42,"tag":220,"props":1176,"children":1178},{"className":1177},[],[1179],{"type":47,"value":1180},"PUT \u002F_security\u002Fuser\u002F{name}\u002F_enable",{"type":47,"value":1182},". See ",{"type":42,"tag":61,"props":1184,"children":1185},{},[1186],{"type":47,"value":72},{"type":47,"value":94},{"type":42,"tag":184,"props":1189,"children":1190},{},[1191,1196],{"type":42,"tag":206,"props":1192,"children":1193},{},[1194],{"type":47,"value":1195},"Expired API key",{"type":42,"tag":206,"props":1197,"children":1198},{},[1199,1201,1205],{"type":47,"value":1200},"Create a new API key. See ",{"type":42,"tag":88,"props":1202,"children":1203},{"href":403},[1204],{"type":47,"value":406},{"type":47,"value":94},{"type":42,"tag":184,"props":1207,"children":1208},{},[1209,1214],{"type":42,"tag":206,"props":1210,"children":1211},{},[1212],{"type":47,"value":1213},"Realm chain order",{"type":42,"tag":206,"props":1215,"children":1216},{},[1217,1219,1225],{"type":47,"value":1218},"Check ",{"type":42,"tag":220,"props":1220,"children":1222},{"className":1221},[],[1223],{"type":47,"value":1224},"elasticsearch.yml",{"type":47,"value":1226}," realm order (self-managed only).",{"type":42,"tag":184,"props":1228,"children":1229},{},[1230,1235],{"type":42,"tag":206,"props":1231,"children":1232},{},[1233],{"type":47,"value":1234},"Security disabled",{"type":42,"tag":206,"props":1236,"children":1237},{},[1238,1240,1246,1248,1253],{"type":47,"value":1239},"Enable ",{"type":42,"tag":220,"props":1241,"children":1243},{"className":1242},[],[1244],{"type":47,"value":1245},"xpack.security.enabled: true",{"type":47,"value":1247}," in ",{"type":42,"tag":220,"props":1249,"children":1251},{"className":1250},[],[1252],{"type":47,"value":1224},{"type":47,"value":1254}," and restart.",{"type":42,"tag":184,"props":1256,"children":1257},{},[1258,1263],{"type":42,"tag":206,"props":1259,"children":1260},{},[1261],{"type":47,"value":1262},"Paid realm after expiry",{"type":42,"tag":206,"props":1264,"children":1265},{},[1266,1268,1272],{"type":47,"value":1267},"License expired — see ",{"type":42,"tag":88,"props":1269,"children":1270},{"href":289},[1271],{"type":47,"value":292},{"type":47,"value":94},{"type":42,"tag":118,"props":1274,"children":1276},{"id":1275},"authorization-failures-403",[1277],{"type":47,"value":1278},"Authorization Failures (403)",{"type":42,"tag":50,"props":1280,"children":1281},{},[1282],{"type":47,"value":1283},"A 403 response means the user is authenticated but lacks the required privileges.",{"type":42,"tag":881,"props":1285,"children":1287},{"id":1286},"gather-1",[1288],{"type":47,"value":886},{"type":42,"tag":50,"props":1290,"children":1291},{},[1292],{"type":47,"value":1293},"Test the specific privileges the operation requires:",{"type":42,"tag":480,"props":1295,"children":1297},{"className":482,"code":1296,"language":484,"meta":485,"style":485},"curl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F_has_privileges\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"index\": [\n      { \"names\": [\"logs-*\"], \"privileges\": [\"read\", \"view_index_metadata\"] }\n    ],\n    \"cluster\": [\"monitor\"]\n  }'\n",[1298],{"type":42,"tag":220,"props":1299,"children":1300},{"__ignoreMap":485},[1301,1340,1363,1386,1401,1408,1416,1424,1432],{"type":42,"tag":491,"props":1302,"children":1303},{"class":493,"line":494},[1304,1308,1312,1316,1320,1324,1328,1332,1336],{"type":42,"tag":491,"props":1305,"children":1306},{"style":498},[1307],{"type":47,"value":501},{"type":42,"tag":491,"props":1309,"children":1310},{"style":510},[1311],{"type":47,"value":637},{"type":42,"tag":491,"props":1313,"children":1314},{"style":510},[1315],{"type":47,"value":642},{"type":42,"tag":491,"props":1317,"children":1318},{"style":504},[1319],{"type":47,"value":529},{"type":42,"tag":491,"props":1321,"children":1322},{"style":516},[1323],{"type":47,"value":534},{"type":42,"tag":491,"props":1325,"children":1326},{"style":504},[1327],{"type":47,"value":539},{"type":42,"tag":491,"props":1329,"children":1330},{"style":510},[1331],{"type":47,"value":659},{"type":42,"tag":491,"props":1333,"children":1334},{"style":504},[1335],{"type":47,"value":664},{"type":42,"tag":491,"props":1337,"children":1338},{"style":516},[1339],{"type":47,"value":669},{"type":42,"tag":491,"props":1341,"children":1342},{"class":493,"line":672},[1343,1347,1351,1355,1359],{"type":42,"tag":491,"props":1344,"children":1345},{"style":504},[1346],{"type":47,"value":678},{"type":42,"tag":491,"props":1348,"children":1349},{"style":510},[1350],{"type":47,"value":513},{"type":42,"tag":491,"props":1352,"children":1353},{"style":516},[1354],{"type":47,"value":519},{"type":42,"tag":491,"props":1356,"children":1357},{"style":504},[1358],{"type":47,"value":524},{"type":42,"tag":491,"props":1360,"children":1361},{"style":516},[1362],{"type":47,"value":669},{"type":42,"tag":491,"props":1364,"children":1365},{"class":493,"line":697},[1366,1370,1374,1378,1382],{"type":42,"tag":491,"props":1367,"children":1368},{"style":510},[1369],{"type":47,"value":703},{"type":42,"tag":491,"props":1371,"children":1372},{"style":504},[1373],{"type":47,"value":708},{"type":42,"tag":491,"props":1375,"children":1376},{"style":510},[1377],{"type":47,"value":713},{"type":42,"tag":491,"props":1379,"children":1380},{"style":504},[1381],{"type":47,"value":664},{"type":42,"tag":491,"props":1383,"children":1384},{"style":516},[1385],{"type":47,"value":669},{"type":42,"tag":491,"props":1387,"children":1388},{"class":493,"line":724},[1389,1393,1397],{"type":42,"tag":491,"props":1390,"children":1391},{"style":510},[1392],{"type":47,"value":730},{"type":42,"tag":491,"props":1394,"children":1395},{"style":504},[1396],{"type":47,"value":735},{"type":42,"tag":491,"props":1398,"children":1399},{"style":510},[1400],{"type":47,"value":740},{"type":42,"tag":491,"props":1402,"children":1403},{"class":493,"line":743},[1404],{"type":42,"tag":491,"props":1405,"children":1406},{"style":510},[1407],{"type":47,"value":749},{"type":42,"tag":491,"props":1409,"children":1410},{"class":493,"line":752},[1411],{"type":42,"tag":491,"props":1412,"children":1413},{"style":510},[1414],{"type":47,"value":1415},"      { \"names\": [\"logs-*\"], \"privileges\": [\"read\", \"view_index_metadata\"] }\n",{"type":42,"tag":491,"props":1417,"children":1418},{"class":493,"line":781},[1419],{"type":42,"tag":491,"props":1420,"children":1421},{"style":510},[1422],{"type":47,"value":1423},"    ],\n",{"type":42,"tag":491,"props":1425,"children":1426},{"class":493,"line":790},[1427],{"type":42,"tag":491,"props":1428,"children":1429},{"style":510},[1430],{"type":47,"value":1431},"    \"cluster\": [\"monitor\"]\n",{"type":42,"tag":491,"props":1433,"children":1435},{"class":493,"line":1434},9,[1436,1440],{"type":42,"tag":491,"props":1437,"children":1438},{"style":510},[1439],{"type":47,"value":796},{"type":42,"tag":491,"props":1441,"children":1442},{"style":504},[1443],{"type":47,"value":801},{"type":42,"tag":50,"props":1445,"children":1446},{},[1447,1449,1455],{"type":47,"value":1448},"The response contains a ",{"type":42,"tag":220,"props":1450,"children":1452},{"className":1451},[],[1453],{"type":47,"value":1454},"has_all_requested",{"type":47,"value":1456}," boolean and per-resource breakdowns.",{"type":42,"tag":50,"props":1458,"children":1459},{},[1460],{"type":47,"value":1461},"Also check the user's effective roles:",{"type":42,"tag":480,"props":1463,"children":1464},{"className":482,"code":483,"language":484,"meta":485,"style":485},[1465],{"type":42,"tag":220,"props":1466,"children":1467},{"__ignoreMap":485},[1468],{"type":42,"tag":491,"props":1469,"children":1470},{"class":493,"line":494},[1471,1475,1479,1483,1487,1491,1495,1499,1503,1507],{"type":42,"tag":491,"props":1472,"children":1473},{"style":498},[1474],{"type":47,"value":501},{"type":42,"tag":491,"props":1476,"children":1477},{"style":504},[1478],{"type":47,"value":507},{"type":42,"tag":491,"props":1480,"children":1481},{"style":510},[1482],{"type":47,"value":513},{"type":42,"tag":491,"props":1484,"children":1485},{"style":516},[1486],{"type":47,"value":519},{"type":42,"tag":491,"props":1488,"children":1489},{"style":504},[1490],{"type":47,"value":524},{"type":42,"tag":491,"props":1492,"children":1493},{"style":504},[1494],{"type":47,"value":529},{"type":42,"tag":491,"props":1496,"children":1497},{"style":516},[1498],{"type":47,"value":534},{"type":42,"tag":491,"props":1500,"children":1501},{"style":504},[1502],{"type":47,"value":539},{"type":42,"tag":491,"props":1504,"children":1505},{"style":510},[1506],{"type":47,"value":544},{"type":42,"tag":491,"props":1508,"children":1509},{"style":504},[1510],{"type":47,"value":549},{"type":42,"tag":50,"props":1512,"children":1513},{},[1514,1516,1522,1524,1530],{"type":47,"value":1515},"Inspect the ",{"type":42,"tag":220,"props":1517,"children":1519},{"className":1518},[],[1520],{"type":47,"value":1521},"roles",{"type":47,"value":1523}," array and ",{"type":42,"tag":220,"props":1525,"children":1527},{"className":1526},[],[1528],{"type":47,"value":1529},"authentication_realm",{"type":47,"value":1531}," to confirm the user is who you expect.",{"type":42,"tag":881,"props":1533,"children":1535},{"id":1534},"diagnose-1",[1536],{"type":47,"value":997},{"type":42,"tag":176,"props":1538,"children":1539},{},[1540,1554],{"type":42,"tag":180,"props":1541,"children":1542},{},[1543],{"type":42,"tag":184,"props":1544,"children":1545},{},[1546,1550],{"type":42,"tag":188,"props":1547,"children":1548},{},[1549],{"type":47,"value":318},{"type":42,"tag":188,"props":1551,"children":1552},{},[1553],{"type":47,"value":1015},{"type":42,"tag":199,"props":1555,"children":1556},{},[1557,1576,1594,1607,1620],{"type":42,"tag":184,"props":1558,"children":1559},{},[1560,1571],{"type":42,"tag":206,"props":1561,"children":1562},{},[1563,1569],{"type":42,"tag":220,"props":1564,"children":1566},{"className":1565},[],[1567],{"type":47,"value":1568},"has_all_requested: false",{"type":47,"value":1570}," for an index",{"type":42,"tag":206,"props":1572,"children":1573},{},[1574],{"type":47,"value":1575},"Role is missing the required index privilege",{"type":42,"tag":184,"props":1577,"children":1578},{},[1579,1589],{"type":42,"tag":206,"props":1580,"children":1581},{},[1582,1587],{"type":42,"tag":220,"props":1583,"children":1585},{"className":1584},[],[1586],{"type":47,"value":1568},{"type":47,"value":1588}," for a cluster",{"type":42,"tag":206,"props":1590,"children":1591},{},[1592],{"type":47,"value":1593},"Role is missing the required cluster privilege",{"type":42,"tag":184,"props":1595,"children":1596},{},[1597,1602],{"type":42,"tag":206,"props":1598,"children":1599},{},[1600],{"type":47,"value":1601},"User has fewer roles than expected",{"type":42,"tag":206,"props":1603,"children":1604},{},[1605],{"type":47,"value":1606},"Roles array was replaced (not merged) on last update",{"type":42,"tag":184,"props":1608,"children":1609},{},[1610,1615],{"type":42,"tag":206,"props":1611,"children":1612},{},[1613],{"type":47,"value":1614},"API key returns 403 on previously allowed",{"type":42,"tag":206,"props":1616,"children":1617},{},[1618],{"type":47,"value":1619},"API key privileges are a snapshot — role changes after",{"type":42,"tag":184,"props":1621,"children":1622},{},[1623,1628],{"type":42,"tag":206,"props":1624,"children":1625},{},[1626],{"type":47,"value":1627},"operation",{"type":42,"tag":206,"props":1629,"children":1630},{},[1631],{"type":47,"value":1632},"creation do not propagate to existing keys",{"type":42,"tag":881,"props":1634,"children":1636},{"id":1635},"resolve-1",[1637],{"type":47,"value":1123},{"type":42,"tag":176,"props":1639,"children":1640},{},[1641,1655],{"type":42,"tag":180,"props":1642,"children":1643},{},[1644],{"type":42,"tag":184,"props":1645,"children":1646},{},[1647,1651],{"type":42,"tag":188,"props":1648,"children":1649},{},[1650],{"type":47,"value":1137},{"type":42,"tag":188,"props":1652,"children":1653},{},[1654],{"type":47,"value":1142},{"type":42,"tag":199,"props":1656,"children":1657},{},[1658,1676,1694,1712],{"type":42,"tag":184,"props":1659,"children":1660},{},[1661,1666],{"type":42,"tag":206,"props":1662,"children":1663},{},[1664],{"type":47,"value":1665},"Missing index privilege",{"type":42,"tag":206,"props":1667,"children":1668},{},[1669,1671,1675],{"type":47,"value":1670},"Add the privilege to the role or create a new role. See ",{"type":42,"tag":61,"props":1672,"children":1673},{},[1674],{"type":47,"value":72},{"type":47,"value":94},{"type":42,"tag":184,"props":1677,"children":1678},{},[1679,1684],{"type":42,"tag":206,"props":1680,"children":1681},{},[1682],{"type":47,"value":1683},"Missing cluster privilege",{"type":42,"tag":206,"props":1685,"children":1686},{},[1687,1689,1693],{"type":47,"value":1688},"Add the cluster privilege. See ",{"type":42,"tag":61,"props":1690,"children":1691},{},[1692],{"type":47,"value":72},{"type":47,"value":94},{"type":42,"tag":184,"props":1695,"children":1696},{},[1697,1702],{"type":42,"tag":206,"props":1698,"children":1699},{},[1700],{"type":47,"value":1701},"Roles replaced on update",{"type":42,"tag":206,"props":1703,"children":1704},{},[1705,1707,1711],{"type":47,"value":1706},"Fetch current roles first, then update with the full array. See ",{"type":42,"tag":61,"props":1708,"children":1709},{},[1710],{"type":47,"value":72},{"type":47,"value":94},{"type":42,"tag":184,"props":1713,"children":1714},{},[1715,1720],{"type":42,"tag":206,"props":1716,"children":1717},{},[1718],{"type":47,"value":1719},"Stale API key privileges",{"type":42,"tag":206,"props":1721,"children":1722},{},[1723,1725,1731,1732,1736],{"type":47,"value":1724},"Create a new API key with updated ",{"type":42,"tag":220,"props":1726,"children":1728},{"className":1727},[],[1729],{"type":47,"value":1730},"role_descriptors",{"type":47,"value":1182},{"type":42,"tag":61,"props":1733,"children":1734},{},[1735],{"type":47,"value":65},{"type":47,"value":94},{"type":42,"tag":118,"props":1738,"children":1740},{"id":1739},"tls-and-certificate-errors",[1741],{"type":47,"value":284},{"type":42,"tag":50,"props":1743,"children":1744},{},[1745],{"type":47,"value":1746},"TLS errors prevent the client from establishing a connection at all.",{"type":42,"tag":881,"props":1748,"children":1750},{"id":1749},"gather-2",[1751],{"type":47,"value":886},{"type":42,"tag":480,"props":1753,"children":1755},{"className":482,"code":1754,"language":484,"meta":485,"style":485},"curl -v --cacert \"${CA_CERT}\" \"https:\u002F\u002F${ELASTICSEARCH_HOST}:9200\u002F\" 2>&1 | head -30\n",[1756],{"type":42,"tag":220,"props":1757,"children":1758},{"__ignoreMap":485},[1759],{"type":42,"tag":491,"props":1760,"children":1761},{"class":493,"line":494},[1762,1766,1770,1775,1779,1784,1789,1793,1798,1803,1808,1812,1817,1821,1826,1831,1836],{"type":42,"tag":491,"props":1763,"children":1764},{"style":498},[1765],{"type":47,"value":501},{"type":42,"tag":491,"props":1767,"children":1768},{"style":510},[1769],{"type":47,"value":905},{"type":42,"tag":491,"props":1771,"children":1772},{"style":510},[1773],{"type":47,"value":1774}," --cacert",{"type":42,"tag":491,"props":1776,"children":1777},{"style":504},[1778],{"type":47,"value":529},{"type":42,"tag":491,"props":1780,"children":1781},{"style":516},[1782],{"type":47,"value":1783},"CA_CERT",{"type":42,"tag":491,"props":1785,"children":1786},{"style":504},[1787],{"type":47,"value":1788},"}\"",{"type":42,"tag":491,"props":1790,"children":1791},{"style":504},[1792],{"type":47,"value":708},{"type":42,"tag":491,"props":1794,"children":1795},{"style":510},[1796],{"type":47,"value":1797},"https:\u002F\u002F",{"type":42,"tag":491,"props":1799,"children":1800},{"style":504},[1801],{"type":47,"value":1802},"${",{"type":42,"tag":491,"props":1804,"children":1805},{"style":516},[1806],{"type":47,"value":1807},"ELASTICSEARCH_HOST",{"type":42,"tag":491,"props":1809,"children":1810},{"style":504},[1811],{"type":47,"value":539},{"type":42,"tag":491,"props":1813,"children":1814},{"style":510},[1815],{"type":47,"value":1816},":9200\u002F",{"type":42,"tag":491,"props":1818,"children":1819},{"style":504},[1820],{"type":47,"value":664},{"type":42,"tag":491,"props":1822,"children":1823},{"style":504},[1824],{"type":47,"value":1825}," 2>&1",{"type":42,"tag":491,"props":1827,"children":1828},{"style":504},[1829],{"type":47,"value":1830}," |",{"type":42,"tag":491,"props":1832,"children":1833},{"style":498},[1834],{"type":47,"value":1835}," head",{"type":42,"tag":491,"props":1837,"children":1838},{"style":510},[1839],{"type":47,"value":1840}," -30\n",{"type":42,"tag":50,"props":1842,"children":1843},{},[1844],{"type":47,"value":1845},"Look for:",{"type":42,"tag":125,"props":1847,"children":1848},{},[1849,1860,1871],{"type":42,"tag":129,"props":1850,"children":1851},{},[1852,1858],{"type":42,"tag":220,"props":1853,"children":1855},{"className":1854},[],[1856],{"type":47,"value":1857},"SSL certificate problem: unable to get local issuer certificate",{"type":47,"value":1859}," — CA not trusted.",{"type":42,"tag":129,"props":1861,"children":1862},{},[1863,1869],{"type":42,"tag":220,"props":1864,"children":1866},{"className":1865},[],[1867],{"type":47,"value":1868},"SSL certificate problem: certificate has expired",{"type":47,"value":1870}," — certificate past its validity date.",{"type":42,"tag":129,"props":1872,"children":1873},{},[1874,1880],{"type":42,"tag":220,"props":1875,"children":1877},{"className":1876},[],[1878],{"type":47,"value":1879},"SSL: no alternative certificate subject name matches target host name",{"type":47,"value":1881}," — hostname mismatch.",{"type":42,"tag":50,"props":1883,"children":1884},{},[1885],{"type":47,"value":1886},"For deeper inspection (self-managed only):",{"type":42,"tag":480,"props":1888,"children":1890},{"className":482,"code":1889,"language":484,"meta":485,"style":485},"openssl s_client -connect \"${ELASTICSEARCH_HOST}:9200\" -showcerts \u003C\u002Fdev\u002Fnull 2>&1\n",[1891],{"type":42,"tag":220,"props":1892,"children":1893},{"__ignoreMap":485},[1894],{"type":42,"tag":491,"props":1895,"children":1896},{"class":493,"line":494},[1897,1902,1907,1912,1916,1920,1924,1929,1933,1938,1942,1947],{"type":42,"tag":491,"props":1898,"children":1899},{"style":498},[1900],{"type":47,"value":1901},"openssl",{"type":42,"tag":491,"props":1903,"children":1904},{"style":510},[1905],{"type":47,"value":1906}," s_client",{"type":42,"tag":491,"props":1908,"children":1909},{"style":510},[1910],{"type":47,"value":1911}," -connect",{"type":42,"tag":491,"props":1913,"children":1914},{"style":504},[1915],{"type":47,"value":529},{"type":42,"tag":491,"props":1917,"children":1918},{"style":516},[1919],{"type":47,"value":1807},{"type":42,"tag":491,"props":1921,"children":1922},{"style":504},[1923],{"type":47,"value":539},{"type":42,"tag":491,"props":1925,"children":1926},{"style":510},[1927],{"type":47,"value":1928},":9200",{"type":42,"tag":491,"props":1930,"children":1931},{"style":504},[1932],{"type":47,"value":664},{"type":42,"tag":491,"props":1934,"children":1935},{"style":510},[1936],{"type":47,"value":1937}," -showcerts",{"type":42,"tag":491,"props":1939,"children":1940},{"style":504},[1941],{"type":47,"value":507},{"type":42,"tag":491,"props":1943,"children":1944},{"style":510},[1945],{"type":47,"value":1946},"\u002Fdev\u002Fnull",{"type":42,"tag":491,"props":1948,"children":1949},{"style":504},[1950],{"type":47,"value":946},{"type":42,"tag":50,"props":1952,"children":1953},{},[1954],{"type":47,"value":1955},"This displays the full certificate chain, expiry dates, and subject alternative names.",{"type":42,"tag":881,"props":1957,"children":1959},{"id":1958},"diagnose-2",[1960],{"type":47,"value":997},{"type":42,"tag":176,"props":1962,"children":1963},{},[1964,1979],{"type":42,"tag":180,"props":1965,"children":1966},{},[1967],{"type":42,"tag":184,"props":1968,"children":1969},{},[1970,1975],{"type":42,"tag":188,"props":1971,"children":1972},{},[1973],{"type":47,"value":1974},"Error message",{"type":42,"tag":188,"props":1976,"children":1977},{},[1978],{"type":47,"value":1015},{"type":42,"tag":199,"props":1980,"children":1981},{},[1982,1999,2016,2033,2050],{"type":42,"tag":184,"props":1983,"children":1984},{},[1985,1994],{"type":42,"tag":206,"props":1986,"children":1987},{},[1988],{"type":42,"tag":220,"props":1989,"children":1991},{"className":1990},[],[1992],{"type":47,"value":1993},"unable to get local issuer certificate",{"type":42,"tag":206,"props":1995,"children":1996},{},[1997],{"type":47,"value":1998},"Missing or wrong CA certificate",{"type":42,"tag":184,"props":2000,"children":2001},{},[2002,2011],{"type":42,"tag":206,"props":2003,"children":2004},{},[2005],{"type":42,"tag":220,"props":2006,"children":2008},{"className":2007},[],[2009],{"type":47,"value":2010},"certificate has expired",{"type":42,"tag":206,"props":2012,"children":2013},{},[2014],{"type":47,"value":2015},"Server or CA certificate past expiry",{"type":42,"tag":184,"props":2017,"children":2018},{},[2019,2028],{"type":42,"tag":206,"props":2020,"children":2021},{},[2022],{"type":42,"tag":220,"props":2023,"children":2025},{"className":2024},[],[2026],{"type":47,"value":2027},"no alternative certificate subject name matches",{"type":42,"tag":206,"props":2029,"children":2030},{},[2031],{"type":47,"value":2032},"Certificate SAN does not include the hostname",{"type":42,"tag":184,"props":2034,"children":2035},{},[2036,2045],{"type":42,"tag":206,"props":2037,"children":2038},{},[2039],{"type":42,"tag":220,"props":2040,"children":2042},{"className":2041},[],[2043],{"type":47,"value":2044},"self-signed certificate",{"type":42,"tag":206,"props":2046,"children":2047},{},[2048],{"type":47,"value":2049},"Self-signed cert not in the trust store",{"type":42,"tag":184,"props":2051,"children":2052},{},[2053,2064],{"type":42,"tag":206,"props":2054,"children":2055},{},[2056,2062],{"type":42,"tag":220,"props":2057,"children":2059},{"className":2058},[],[2060],{"type":47,"value":2061},"SSLHandshakeException",{"type":47,"value":2063}," (Java client)",{"type":42,"tag":206,"props":2065,"children":2066},{},[2067],{"type":47,"value":2068},"Truststore missing the CA or wrong password",{"type":42,"tag":881,"props":2070,"children":2072},{"id":2071},"resolve-2",[2073],{"type":47,"value":1123},{"type":42,"tag":176,"props":2075,"children":2076},{},[2077,2091],{"type":42,"tag":180,"props":2078,"children":2079},{},[2080],{"type":42,"tag":184,"props":2081,"children":2082},{},[2083,2087],{"type":42,"tag":188,"props":2084,"children":2085},{},[2086],{"type":47,"value":1137},{"type":42,"tag":188,"props":2088,"children":2089},{},[2090],{"type":47,"value":1142},{"type":42,"tag":199,"props":2092,"children":2093},{},[2094,2115,2136,2149,2162],{"type":42,"tag":184,"props":2095,"children":2096},{},[2097,2102],{"type":42,"tag":206,"props":2098,"children":2099},{},[2100],{"type":47,"value":2101},"Wrong CA cert",{"type":42,"tag":206,"props":2103,"children":2104},{},[2105,2107,2113],{"type":47,"value":2106},"Pass the correct CA with ",{"type":42,"tag":220,"props":2108,"children":2110},{"className":2109},[],[2111],{"type":47,"value":2112},"--cacert",{"type":47,"value":2114}," or add it to the system trust store.",{"type":42,"tag":184,"props":2116,"children":2117},{},[2118,2123],{"type":42,"tag":206,"props":2119,"children":2120},{},[2121],{"type":47,"value":2122},"Expired certificate",{"type":42,"tag":206,"props":2124,"children":2125},{},[2126,2128,2134],{"type":47,"value":2127},"Regenerate certificates with ",{"type":42,"tag":220,"props":2129,"children":2131},{"className":2130},[],[2132],{"type":47,"value":2133},"elasticsearch-certutil",{"type":47,"value":2135}," (self-managed).",{"type":42,"tag":184,"props":2137,"children":2138},{},[2139,2144],{"type":42,"tag":206,"props":2140,"children":2141},{},[2142],{"type":47,"value":2143},"Hostname mismatch",{"type":42,"tag":206,"props":2145,"children":2146},{},[2147],{"type":47,"value":2148},"Regenerate the certificate with the correct SAN entries.",{"type":42,"tag":184,"props":2150,"children":2151},{},[2152,2157],{"type":42,"tag":206,"props":2153,"children":2154},{},[2155],{"type":47,"value":2156},"Self-signed cert",{"type":42,"tag":206,"props":2158,"children":2159},{},[2160],{"type":47,"value":2161},"Distribute the CA cert to all clients or use a publicly trusted CA.",{"type":42,"tag":184,"props":2163,"children":2164},{},[2165,2170],{"type":42,"tag":206,"props":2166,"children":2167},{},[2168],{"type":47,"value":2169},"Quick workaround",{"type":42,"tag":206,"props":2171,"children":2172},{},[2173,2175,2181,2183,2189,2191],{"type":47,"value":2174},"Use ",{"type":42,"tag":220,"props":2176,"children":2178},{"className":2177},[],[2179],{"type":47,"value":2180},"curl -k",{"type":47,"value":2182}," \u002F ",{"type":42,"tag":220,"props":2184,"children":2186},{"className":2185},[],[2187],{"type":47,"value":2188},"--insecure",{"type":47,"value":2190}," to skip verification. ",{"type":42,"tag":61,"props":2192,"children":2193},{},[2194],{"type":47,"value":2195},"Not for production.",{"type":42,"tag":50,"props":2197,"children":2198},{},[2199],{"type":47,"value":2200},"On ECH, TLS is managed by Elastic — certificate errors usually indicate the client is not using the correct Cloud\nendpoint URL. On Serverless, TLS is fully managed and transparent.",{"type":42,"tag":118,"props":2202,"children":2204},{"id":2203},"api-key-issues",[2205],{"type":47,"value":406},{"type":42,"tag":881,"props":2207,"children":2209},{"id":2208},"gather-3",[2210],{"type":47,"value":886},{"type":42,"tag":50,"props":2212,"children":2213},{},[2214],{"type":47,"value":2215},"Retrieve the key's metadata:",{"type":42,"tag":480,"props":2217,"children":2219},{"className":482,"code":2218,"language":484,"meta":485,"style":485},"curl \"${ELASTICSEARCH_URL}\u002F_security\u002Fapi_key?name=${KEY_NAME}\" \u003Cauth_flags>\n",[2220],{"type":42,"tag":220,"props":2221,"children":2222},{"__ignoreMap":485},[2223],{"type":42,"tag":491,"props":2224,"children":2225},{"class":493,"line":494},[2226,2230,2234,2238,2242,2247,2251,2256,2260,2264,2268,2272],{"type":42,"tag":491,"props":2227,"children":2228},{"style":498},[2229],{"type":47,"value":501},{"type":42,"tag":491,"props":2231,"children":2232},{"style":504},[2233],{"type":47,"value":529},{"type":42,"tag":491,"props":2235,"children":2236},{"style":516},[2237],{"type":47,"value":534},{"type":42,"tag":491,"props":2239,"children":2240},{"style":504},[2241],{"type":47,"value":539},{"type":42,"tag":491,"props":2243,"children":2244},{"style":510},[2245],{"type":47,"value":2246},"\u002F_security\u002Fapi_key?name=",{"type":42,"tag":491,"props":2248,"children":2249},{"style":504},[2250],{"type":47,"value":1802},{"type":42,"tag":491,"props":2252,"children":2253},{"style":516},[2254],{"type":47,"value":2255},"KEY_NAME",{"type":42,"tag":491,"props":2257,"children":2258},{"style":504},[2259],{"type":47,"value":1788},{"type":42,"tag":491,"props":2261,"children":2262},{"style":504},[2263],{"type":47,"value":507},{"type":42,"tag":491,"props":2265,"children":2266},{"style":510},[2267],{"type":47,"value":513},{"type":42,"tag":491,"props":2269,"children":2270},{"style":516},[2271],{"type":47,"value":519},{"type":42,"tag":491,"props":2273,"children":2274},{"style":504},[2275],{"type":47,"value":2276},">\n",{"type":42,"tag":50,"props":2278,"children":2279},{},[2280,2281,2287,2289,2295,2297,2302],{"type":47,"value":1218},{"type":42,"tag":220,"props":2282,"children":2284},{"className":2283},[],[2285],{"type":47,"value":2286},"expiration",{"type":47,"value":2288},", ",{"type":42,"tag":220,"props":2290,"children":2292},{"className":2291},[],[2293],{"type":47,"value":2294},"invalidated",{"type":47,"value":2296},", and ",{"type":42,"tag":220,"props":2298,"children":2300},{"className":2299},[],[2301],{"type":47,"value":1730},{"type":47,"value":2303}," in the response.",{"type":42,"tag":881,"props":2305,"children":2307},{"id":2306},"diagnose-3",[2308],{"type":47,"value":997},{"type":42,"tag":176,"props":2310,"children":2311},{},[2312,2326],{"type":42,"tag":180,"props":2313,"children":2314},{},[2315],{"type":42,"tag":184,"props":2316,"children":2317},{},[2318,2322],{"type":42,"tag":188,"props":2319,"children":2320},{},[2321],{"type":47,"value":318},{"type":42,"tag":188,"props":2323,"children":2324},{},[2325],{"type":47,"value":1015},{"type":42,"tag":199,"props":2327,"children":2328},{},[2329,2342,2360,2373],{"type":42,"tag":184,"props":2330,"children":2331},{},[2332,2337],{"type":42,"tag":206,"props":2333,"children":2334},{},[2335],{"type":47,"value":2336},"401 when using the key",{"type":42,"tag":206,"props":2338,"children":2339},{},[2340],{"type":47,"value":2341},"Key expired or invalidated",{"type":42,"tag":184,"props":2343,"children":2344},{},[2345,2350],{"type":42,"tag":206,"props":2346,"children":2347},{},[2348],{"type":47,"value":2349},"403 on operations that should be allowed",{"type":42,"tag":206,"props":2351,"children":2352},{},[2353,2355],{"type":47,"value":2354},"Key was created with insufficient ",{"type":42,"tag":220,"props":2356,"children":2358},{"className":2357},[],[2359],{"type":47,"value":1730},{"type":42,"tag":184,"props":2361,"children":2362},{},[2363,2368],{"type":42,"tag":206,"props":2364,"children":2365},{},[2366],{"type":47,"value":2367},"Derived key has no access",{"type":42,"tag":206,"props":2369,"children":2370},{},[2371],{"type":47,"value":2372},"API key created another API key — derived keys have no privilege",{"type":42,"tag":184,"props":2374,"children":2375},{},[2376,2381],{"type":42,"tag":206,"props":2377,"children":2378},{},[2379],{"type":47,"value":2380},"Key works for some indices but not others",{"type":42,"tag":206,"props":2382,"children":2383},{},[2384,2389],{"type":42,"tag":220,"props":2385,"children":2387},{"className":2386},[],[2388],{"type":47,"value":1730},{"type":47,"value":2390}," scope is too narrow",{"type":42,"tag":881,"props":2392,"children":2394},{"id":2393},"resolve-3",[2395],{"type":47,"value":1123},{"type":42,"tag":176,"props":2397,"children":2398},{},[2399,2413],{"type":42,"tag":180,"props":2400,"children":2401},{},[2402],{"type":42,"tag":184,"props":2403,"children":2404},{},[2405,2409],{"type":42,"tag":188,"props":2406,"children":2407},{},[2408],{"type":47,"value":1137},{"type":42,"tag":188,"props":2410,"children":2411},{},[2412],{"type":47,"value":1142},{"type":42,"tag":199,"props":2414,"children":2415},{},[2416,2440,2453,2477],{"type":42,"tag":184,"props":2417,"children":2418},{},[2419,2424],{"type":42,"tag":206,"props":2420,"children":2421},{},[2422],{"type":47,"value":2423},"Expired key",{"type":42,"tag":206,"props":2425,"children":2426},{},[2427,2429,2434,2435,2439],{"type":47,"value":2428},"Create a new key with appropriate ",{"type":42,"tag":220,"props":2430,"children":2432},{"className":2431},[],[2433],{"type":47,"value":2286},{"type":47,"value":1182},{"type":42,"tag":61,"props":2436,"children":2437},{},[2438],{"type":47,"value":65},{"type":47,"value":94},{"type":42,"tag":184,"props":2441,"children":2442},{},[2443,2448],{"type":42,"tag":206,"props":2444,"children":2445},{},[2446],{"type":47,"value":2447},"Invalidated key",{"type":42,"tag":206,"props":2449,"children":2450},{},[2451],{"type":47,"value":2452},"Create a new key. Invalidated keys cannot be reinstated.",{"type":42,"tag":184,"props":2454,"children":2455},{},[2456,2461],{"type":42,"tag":206,"props":2457,"children":2458},{},[2459],{"type":47,"value":2460},"Wrong scope",{"type":42,"tag":206,"props":2462,"children":2463},{},[2464,2466,2471,2472,2476],{"type":47,"value":2465},"Create a new key with correct ",{"type":42,"tag":220,"props":2467,"children":2469},{"className":2468},[],[2470],{"type":47,"value":1730},{"type":47,"value":1182},{"type":42,"tag":61,"props":2473,"children":2474},{},[2475],{"type":47,"value":65},{"type":47,"value":94},{"type":42,"tag":184,"props":2478,"children":2479},{},[2480,2485],{"type":42,"tag":206,"props":2481,"children":2482},{},[2483],{"type":47,"value":2484},"Derived key problem",{"type":42,"tag":206,"props":2486,"children":2487},{},[2488,2489,2495,2497,2501],{"type":47,"value":2174},{"type":42,"tag":220,"props":2490,"children":2492},{"className":2491},[],[2493],{"type":47,"value":2494},"POST \u002F_security\u002Fapi_key\u002Fgrant",{"type":47,"value":2496}," with user credentials instead. See ",{"type":42,"tag":61,"props":2498,"children":2499},{},[2500],{"type":47,"value":65},{"type":47,"value":94},{"type":42,"tag":118,"props":2503,"children":2505},{"id":2504},"role-mapping-issues",[2506],{"type":47,"value":423},{"type":42,"tag":50,"props":2508,"children":2509},{},[2510],{"type":47,"value":2511},"Role mappings grant roles to users from external realms. When they fail silently, users authenticate but get no roles.",{"type":42,"tag":881,"props":2513,"children":2515},{"id":2514},"gather-4",[2516],{"type":47,"value":886},{"type":42,"tag":480,"props":2518,"children":2519},{"className":482,"code":483,"language":484,"meta":485,"style":485},[2520],{"type":42,"tag":220,"props":2521,"children":2522},{"__ignoreMap":485},[2523],{"type":42,"tag":491,"props":2524,"children":2525},{"class":493,"line":494},[2526,2530,2534,2538,2542,2546,2550,2554,2558,2562],{"type":42,"tag":491,"props":2527,"children":2528},{"style":498},[2529],{"type":47,"value":501},{"type":42,"tag":491,"props":2531,"children":2532},{"style":504},[2533],{"type":47,"value":507},{"type":42,"tag":491,"props":2535,"children":2536},{"style":510},[2537],{"type":47,"value":513},{"type":42,"tag":491,"props":2539,"children":2540},{"style":516},[2541],{"type":47,"value":519},{"type":42,"tag":491,"props":2543,"children":2544},{"style":504},[2545],{"type":47,"value":524},{"type":42,"tag":491,"props":2547,"children":2548},{"style":504},[2549],{"type":47,"value":529},{"type":42,"tag":491,"props":2551,"children":2552},{"style":516},[2553],{"type":47,"value":534},{"type":42,"tag":491,"props":2555,"children":2556},{"style":504},[2557],{"type":47,"value":539},{"type":42,"tag":491,"props":2559,"children":2560},{"style":510},[2561],{"type":47,"value":544},{"type":42,"tag":491,"props":2563,"children":2564},{"style":504},[2565],{"type":47,"value":549},{"type":42,"tag":50,"props":2567,"children":2568},{},[2569,2571,2577,2578,2584,2585,2590],{"type":47,"value":2570},"Note the ",{"type":42,"tag":220,"props":2572,"children":2574},{"className":2573},[],[2575],{"type":47,"value":2576},"username",{"type":47,"value":2288},{"type":42,"tag":220,"props":2579,"children":2581},{"className":2580},[],[2582],{"type":47,"value":2583},"authentication_realm.name",{"type":47,"value":2296},{"type":42,"tag":220,"props":2586,"children":2588},{"className":2587},[],[2589],{"type":47,"value":1521},{"type":47,"value":2591}," array.",{"type":42,"tag":480,"props":2593,"children":2595},{"className":482,"code":2594,"language":484,"meta":485,"style":485},"curl \u003Cauth_flags> \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\"\n",[2596],{"type":42,"tag":220,"props":2597,"children":2598},{"__ignoreMap":485},[2599],{"type":42,"tag":491,"props":2600,"children":2601},{"class":493,"line":494},[2602,2606,2610,2614,2618,2622,2626,2630,2634,2639],{"type":42,"tag":491,"props":2603,"children":2604},{"style":498},[2605],{"type":47,"value":501},{"type":42,"tag":491,"props":2607,"children":2608},{"style":504},[2609],{"type":47,"value":507},{"type":42,"tag":491,"props":2611,"children":2612},{"style":510},[2613],{"type":47,"value":513},{"type":42,"tag":491,"props":2615,"children":2616},{"style":516},[2617],{"type":47,"value":519},{"type":42,"tag":491,"props":2619,"children":2620},{"style":504},[2621],{"type":47,"value":524},{"type":42,"tag":491,"props":2623,"children":2624},{"style":504},[2625],{"type":47,"value":529},{"type":42,"tag":491,"props":2627,"children":2628},{"style":516},[2629],{"type":47,"value":534},{"type":42,"tag":491,"props":2631,"children":2632},{"style":504},[2633],{"type":47,"value":539},{"type":42,"tag":491,"props":2635,"children":2636},{"style":510},[2637],{"type":47,"value":2638},"\u002F_security\u002Frole_mapping",{"type":42,"tag":491,"props":2640,"children":2641},{"style":504},[2642],{"type":47,"value":549},{"type":42,"tag":50,"props":2644,"children":2645},{},[2646,2648,2654,2656,2662],{"type":47,"value":2647},"List all mappings and inspect their ",{"type":42,"tag":220,"props":2649,"children":2651},{"className":2650},[],[2652],{"type":47,"value":2653},"rules",{"type":47,"value":2655}," and ",{"type":42,"tag":220,"props":2657,"children":2659},{"className":2658},[],[2660],{"type":47,"value":2661},"enabled",{"type":47,"value":2663}," fields.",{"type":42,"tag":881,"props":2665,"children":2667},{"id":2666},"diagnose-4",[2668],{"type":47,"value":997},{"type":42,"tag":176,"props":2670,"children":2671},{},[2672,2686],{"type":42,"tag":180,"props":2673,"children":2674},{},[2675],{"type":42,"tag":184,"props":2676,"children":2677},{},[2678,2682],{"type":42,"tag":188,"props":2679,"children":2680},{},[2681],{"type":47,"value":318},{"type":42,"tag":188,"props":2683,"children":2684},{},[2685],{"type":47,"value":1015},{"type":42,"tag":199,"props":2687,"children":2688},{},[2689,2709,2722,2746],{"type":42,"tag":184,"props":2690,"children":2691},{},[2692,2704],{"type":42,"tag":206,"props":2693,"children":2694},{},[2695,2697,2702],{"type":47,"value":2696},"User has empty ",{"type":42,"tag":220,"props":2698,"children":2700},{"className":2699},[],[2701],{"type":47,"value":1521},{"type":47,"value":2703}," array",{"type":42,"tag":206,"props":2705,"children":2706},{},[2707],{"type":47,"value":2708},"No mapping matches the user's attributes",{"type":42,"tag":184,"props":2710,"children":2711},{},[2712,2717],{"type":42,"tag":206,"props":2713,"children":2714},{},[2715],{"type":47,"value":2716},"User gets wrong roles",{"type":42,"tag":206,"props":2718,"children":2719},{},[2720],{"type":47,"value":2721},"A different mapping matched first or the rule is too broad",{"type":42,"tag":184,"props":2723,"children":2724},{},[2725,2730],{"type":42,"tag":206,"props":2726,"children":2727},{},[2728],{"type":47,"value":2729},"Mapping exists but does not apply",{"type":42,"tag":206,"props":2731,"children":2732},{},[2733,2738,2740],{"type":42,"tag":220,"props":2734,"children":2736},{"className":2735},[],[2737],{"type":47,"value":2661},{"type":47,"value":2739}," is ",{"type":42,"tag":220,"props":2741,"children":2743},{"className":2742},[],[2744],{"type":47,"value":2745},"false",{"type":42,"tag":184,"props":2747,"children":2748},{},[2749,2754],{"type":42,"tag":206,"props":2750,"children":2751},{},[2752],{"type":47,"value":2753},"Mustache template produces wrong role name",{"type":42,"tag":206,"props":2755,"children":2756},{},[2757],{"type":47,"value":2758},"Template syntax error or unexpected attribute value",{"type":42,"tag":50,"props":2760,"children":2761},{},[2762,2764,2769,2770,2776,2778,2784,2786,2791],{"type":47,"value":2763},"Compare the user's ",{"type":42,"tag":220,"props":2765,"children":2767},{"className":2766},[],[2768],{"type":47,"value":2583},{"type":47,"value":2655},{"type":42,"tag":220,"props":2771,"children":2773},{"className":2772},[],[2774],{"type":47,"value":2775},"groups",{"type":47,"value":2777}," (from ",{"type":42,"tag":220,"props":2779,"children":2781},{"className":2780},[],[2782],{"type":47,"value":2783},"_authenticate",{"type":47,"value":2785},") against each mapping's ",{"type":42,"tag":220,"props":2787,"children":2789},{"className":2788},[],[2790],{"type":47,"value":2653},{"type":47,"value":2792}," to\nfind the mismatch.",{"type":42,"tag":881,"props":2794,"children":2796},{"id":2795},"resolve-4",[2797],{"type":47,"value":1123},{"type":42,"tag":176,"props":2799,"children":2800},{},[2801,2815],{"type":42,"tag":180,"props":2802,"children":2803},{},[2804],{"type":42,"tag":184,"props":2805,"children":2806},{},[2807,2811],{"type":42,"tag":188,"props":2808,"children":2809},{},[2810],{"type":47,"value":1137},{"type":42,"tag":188,"props":2812,"children":2813},{},[2814],{"type":47,"value":1142},{"type":42,"tag":199,"props":2816,"children":2817},{},[2818,2831,2852,2870],{"type":42,"tag":184,"props":2819,"children":2820},{},[2821,2826],{"type":42,"tag":206,"props":2822,"children":2823},{},[2824],{"type":47,"value":2825},"No matching rule",{"type":42,"tag":206,"props":2827,"children":2828},{},[2829],{"type":47,"value":2830},"Update the mapping rules to match the user's realm and attributes.",{"type":42,"tag":184,"props":2832,"children":2833},{},[2834,2839],{"type":42,"tag":206,"props":2835,"children":2836},{},[2837],{"type":47,"value":2838},"Mapping disabled",{"type":42,"tag":206,"props":2840,"children":2841},{},[2842,2844,2850],{"type":47,"value":2843},"Set ",{"type":42,"tag":220,"props":2845,"children":2847},{"className":2846},[],[2848],{"type":47,"value":2849},"\"enabled\": true",{"type":47,"value":2851}," on the mapping.",{"type":42,"tag":184,"props":2853,"children":2854},{},[2855,2860],{"type":42,"tag":206,"props":2856,"children":2857},{},[2858],{"type":47,"value":2859},"Template error",{"type":42,"tag":206,"props":2861,"children":2862},{},[2863,2865,2869],{"type":47,"value":2864},"Test the Mustache template with known attribute values. See ",{"type":42,"tag":61,"props":2866,"children":2867},{},[2868],{"type":47,"value":72},{"type":47,"value":94},{"type":42,"tag":184,"props":2871,"children":2872},{},[2873,2878],{"type":42,"tag":206,"props":2874,"children":2875},{},[2876],{"type":47,"value":2877},"Rule too broad",{"type":42,"tag":206,"props":2879,"children":2880},{},[2881,2883,2889,2890,2896,2898,2902],{"type":47,"value":2882},"Add ",{"type":42,"tag":220,"props":2884,"children":2886},{"className":2885},[],[2887],{"type":47,"value":2888},"all",{"type":47,"value":2182},{"type":42,"tag":220,"props":2891,"children":2893},{"className":2892},[],[2894],{"type":47,"value":2895},"except",{"type":47,"value":2897}," conditions to narrow the match. See ",{"type":42,"tag":61,"props":2899,"children":2900},{},[2901],{"type":47,"value":72},{"type":47,"value":94},{"type":42,"tag":118,"props":2904,"children":2906},{"id":2905},"kibana-authentication-issues",[2907],{"type":47,"value":440},{"type":42,"tag":881,"props":2909,"children":2911},{"id":2910},"missing-kbn-xsrf-header",[2912,2914,2920],{"type":47,"value":2913},"Missing ",{"type":42,"tag":220,"props":2915,"children":2917},{"className":2916},[],[2918],{"type":47,"value":2919},"kbn-xsrf",{"type":47,"value":1101},{"type":42,"tag":50,"props":2922,"children":2923},{},[2924,2926,2931],{"type":47,"value":2925},"All mutating Kibana API requests require the ",{"type":42,"tag":220,"props":2927,"children":2929},{"className":2928},[],[2930],{"type":47,"value":2919},{"type":47,"value":2932}," header:",{"type":42,"tag":480,"props":2934,"children":2936},{"className":482,"code":2935,"language":484,"meta":485,"style":485},"curl -X PUT \"${KIBANA_URL}\u002Fapi\u002Fsecurity\u002Frole\u002Fmy-role\" \\\n  \u003Cauth_flags> \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{ ... }'\n",[2937],{"type":42,"tag":220,"props":2938,"children":2939},{"__ignoreMap":485},[2940,2982,3005,3029,3052],{"type":42,"tag":491,"props":2941,"children":2942},{"class":493,"line":494},[2943,2947,2951,2956,2960,2965,2969,2974,2978],{"type":42,"tag":491,"props":2944,"children":2945},{"style":498},[2946],{"type":47,"value":501},{"type":42,"tag":491,"props":2948,"children":2949},{"style":510},[2950],{"type":47,"value":637},{"type":42,"tag":491,"props":2952,"children":2953},{"style":510},[2954],{"type":47,"value":2955}," PUT",{"type":42,"tag":491,"props":2957,"children":2958},{"style":504},[2959],{"type":47,"value":529},{"type":42,"tag":491,"props":2961,"children":2962},{"style":516},[2963],{"type":47,"value":2964},"KIBANA_URL",{"type":42,"tag":491,"props":2966,"children":2967},{"style":504},[2968],{"type":47,"value":539},{"type":42,"tag":491,"props":2970,"children":2971},{"style":510},[2972],{"type":47,"value":2973},"\u002Fapi\u002Fsecurity\u002Frole\u002Fmy-role",{"type":42,"tag":491,"props":2975,"children":2976},{"style":504},[2977],{"type":47,"value":664},{"type":42,"tag":491,"props":2979,"children":2980},{"style":516},[2981],{"type":47,"value":669},{"type":42,"tag":491,"props":2983,"children":2984},{"class":493,"line":672},[2985,2989,2993,2997,3001],{"type":42,"tag":491,"props":2986,"children":2987},{"style":504},[2988],{"type":47,"value":678},{"type":42,"tag":491,"props":2990,"children":2991},{"style":510},[2992],{"type":47,"value":513},{"type":42,"tag":491,"props":2994,"children":2995},{"style":516},[2996],{"type":47,"value":519},{"type":42,"tag":491,"props":2998,"children":2999},{"style":504},[3000],{"type":47,"value":524},{"type":42,"tag":491,"props":3002,"children":3003},{"style":516},[3004],{"type":47,"value":669},{"type":42,"tag":491,"props":3006,"children":3007},{"class":493,"line":697},[3008,3012,3016,3021,3025],{"type":42,"tag":491,"props":3009,"children":3010},{"style":510},[3011],{"type":47,"value":703},{"type":42,"tag":491,"props":3013,"children":3014},{"style":504},[3015],{"type":47,"value":708},{"type":42,"tag":491,"props":3017,"children":3018},{"style":510},[3019],{"type":47,"value":3020},"kbn-xsrf: true",{"type":42,"tag":491,"props":3022,"children":3023},{"style":504},[3024],{"type":47,"value":664},{"type":42,"tag":491,"props":3026,"children":3027},{"style":516},[3028],{"type":47,"value":669},{"type":42,"tag":491,"props":3030,"children":3031},{"class":493,"line":724},[3032,3036,3040,3044,3048],{"type":42,"tag":491,"props":3033,"children":3034},{"style":510},[3035],{"type":47,"value":703},{"type":42,"tag":491,"props":3037,"children":3038},{"style":504},[3039],{"type":47,"value":708},{"type":42,"tag":491,"props":3041,"children":3042},{"style":510},[3043],{"type":47,"value":713},{"type":42,"tag":491,"props":3045,"children":3046},{"style":504},[3047],{"type":47,"value":664},{"type":42,"tag":491,"props":3049,"children":3050},{"style":516},[3051],{"type":47,"value":669},{"type":42,"tag":491,"props":3053,"children":3054},{"class":493,"line":743},[3055,3059,3063,3068],{"type":42,"tag":491,"props":3056,"children":3057},{"style":510},[3058],{"type":47,"value":730},{"type":42,"tag":491,"props":3060,"children":3061},{"style":504},[3062],{"type":47,"value":735},{"type":42,"tag":491,"props":3064,"children":3065},{"style":510},[3066],{"type":47,"value":3067},"{ ... }",{"type":42,"tag":491,"props":3069,"children":3070},{"style":504},[3071],{"type":47,"value":801},{"type":42,"tag":50,"props":3073,"children":3074},{},[3075,3077,3083,3085,3091],{"type":47,"value":3076},"Without it, Kibana returns ",{"type":42,"tag":220,"props":3078,"children":3080},{"className":3079},[],[3081],{"type":47,"value":3082},"400 Bad Request",{"type":47,"value":3084}," with ",{"type":42,"tag":220,"props":3086,"children":3088},{"className":3087},[],[3089],{"type":47,"value":3090},"\"Request must contain a kbn-xsrf header\"",{"type":47,"value":94},{"type":42,"tag":881,"props":3093,"children":3095},{"id":3094},"samloidc-redirect-loop",[3096],{"type":47,"value":3097},"SAML\u002FOIDC redirect loop",{"type":42,"tag":50,"props":3099,"children":3100},{},[3101],{"type":47,"value":3102},"Common causes:",{"type":42,"tag":125,"props":3104,"children":3105},{},[3106,3131,3136],{"type":42,"tag":129,"props":3107,"children":3108},{},[3109,3111,3117,3118,3124,3125,3130],{"type":47,"value":3110},"Incorrect ",{"type":42,"tag":220,"props":3112,"children":3114},{"className":3113},[],[3115],{"type":47,"value":3116},"xpack.security.authc.realms.saml.*.sp.acs",{"type":47,"value":286},{"type":42,"tag":220,"props":3119,"children":3121},{"className":3120},[],[3122],{"type":47,"value":3123},"idp.metadata.path",{"type":47,"value":1247},{"type":42,"tag":220,"props":3126,"children":3128},{"className":3127},[],[3129],{"type":47,"value":1224},{"type":47,"value":94},{"type":42,"tag":129,"props":3132,"children":3133},{},[3134],{"type":47,"value":3135},"Clock skew between the IdP and Elasticsearch nodes (SAML assertions have a validity window).",{"type":42,"tag":129,"props":3137,"children":3138},{},[3139,3141,3147],{"type":47,"value":3140},"Kibana ",{"type":42,"tag":220,"props":3142,"children":3144},{"className":3143},[],[3145],{"type":47,"value":3146},"server.publicBaseUrl",{"type":47,"value":3148}," does not match the SAML ACS URL.",{"type":42,"tag":50,"props":3150,"children":3151},{},[3152],{"type":47,"value":3153},"Verify the SAML realm configuration:",{"type":42,"tag":480,"props":3155,"children":3156},{"className":482,"code":483,"language":484,"meta":485,"style":485},[3157],{"type":42,"tag":220,"props":3158,"children":3159},{"__ignoreMap":485},[3160],{"type":42,"tag":491,"props":3161,"children":3162},{"class":493,"line":494},[3163,3167,3171,3175,3179,3183,3187,3191,3195,3199],{"type":42,"tag":491,"props":3164,"children":3165},{"style":498},[3166],{"type":47,"value":501},{"type":42,"tag":491,"props":3168,"children":3169},{"style":504},[3170],{"type":47,"value":507},{"type":42,"tag":491,"props":3172,"children":3173},{"style":510},[3174],{"type":47,"value":513},{"type":42,"tag":491,"props":3176,"children":3177},{"style":516},[3178],{"type":47,"value":519},{"type":42,"tag":491,"props":3180,"children":3181},{"style":504},[3182],{"type":47,"value":524},{"type":42,"tag":491,"props":3184,"children":3185},{"style":504},[3186],{"type":47,"value":529},{"type":42,"tag":491,"props":3188,"children":3189},{"style":516},[3190],{"type":47,"value":534},{"type":42,"tag":491,"props":3192,"children":3193},{"style":504},[3194],{"type":47,"value":539},{"type":42,"tag":491,"props":3196,"children":3197},{"style":510},[3198],{"type":47,"value":544},{"type":42,"tag":491,"props":3200,"children":3201},{"style":504},[3202],{"type":47,"value":549},{"type":42,"tag":50,"props":3204,"children":3205},{},[3206],{"type":47,"value":3207},"If this returns a valid user via a non-SAML realm, the SAML realm itself is not being reached. Check realm chain order.",{"type":42,"tag":881,"props":3209,"children":3211},{"id":3210},"kibana-cannot-reach-elasticsearch",[3212],{"type":47,"value":3213},"Kibana cannot reach Elasticsearch",{"type":42,"tag":50,"props":3215,"children":3216},{},[3217,3219,3225,3227,3233,3235,3241,3243,3249,3250,3256,3258,3264],{"type":47,"value":3218},"Kibana logs ",{"type":42,"tag":220,"props":3220,"children":3222},{"className":3221},[],[3223],{"type":47,"value":3224},"Unable to retrieve version information from Elasticsearch nodes",{"type":47,"value":3226},". Verify the ",{"type":42,"tag":220,"props":3228,"children":3230},{"className":3229},[],[3231],{"type":47,"value":3232},"elasticsearch.hosts",{"type":47,"value":3234}," setting\nin ",{"type":42,"tag":220,"props":3236,"children":3238},{"className":3237},[],[3239],{"type":47,"value":3240},"kibana.yml",{"type":47,"value":3242}," points to a reachable endpoint and the credentials (",{"type":42,"tag":220,"props":3244,"children":3246},{"className":3245},[],[3247],{"type":47,"value":3248},"elasticsearch.username",{"type":47,"value":2182},{"type":42,"tag":220,"props":3251,"children":3253},{"className":3252},[],[3254],{"type":47,"value":3255},"elasticsearch.password",{"type":47,"value":3257},"\nor ",{"type":42,"tag":220,"props":3259,"children":3261},{"className":3260},[],[3262],{"type":47,"value":3263},"elasticsearch.serviceAccountToken",{"type":47,"value":3265},") are valid.",{"type":42,"tag":118,"props":3267,"children":3269},{"id":3268},"license-expiry-recovery",[3270],{"type":47,"value":292},{"type":42,"tag":50,"props":3272,"children":3273},{},[3274,3276,3281],{"type":47,"value":3275},"When a paid license expires, the cluster enters a ",{"type":42,"tag":61,"props":3277,"children":3278},{},[3279],{"type":47,"value":3280},"security-closed",{"type":47,"value":3282}," state: paid realms (SAML, LDAP, AD, PKI) stop\nworking and users authenticating through them are locked out. Native and file realms remain functional.",{"type":42,"tag":881,"props":3284,"children":3286},{"id":3285},"quick-triage",[3287],{"type":47,"value":3288},"Quick triage",{"type":42,"tag":480,"props":3290,"children":3291},{"className":482,"code":815,"language":484,"meta":485,"style":485},[3292],{"type":42,"tag":220,"props":3293,"children":3294},{"__ignoreMap":485},[3295],{"type":42,"tag":491,"props":3296,"children":3297},{"class":493,"line":494},[3298,3302,3306,3310,3314,3318,3322,3326,3330,3334],{"type":42,"tag":491,"props":3299,"children":3300},{"style":498},[3301],{"type":47,"value":501},{"type":42,"tag":491,"props":3303,"children":3304},{"style":504},[3305],{"type":47,"value":507},{"type":42,"tag":491,"props":3307,"children":3308},{"style":510},[3309],{"type":47,"value":513},{"type":42,"tag":491,"props":3311,"children":3312},{"style":516},[3313],{"type":47,"value":519},{"type":42,"tag":491,"props":3315,"children":3316},{"style":504},[3317],{"type":47,"value":524},{"type":42,"tag":491,"props":3319,"children":3320},{"style":504},[3321],{"type":47,"value":529},{"type":42,"tag":491,"props":3323,"children":3324},{"style":516},[3325],{"type":47,"value":534},{"type":42,"tag":491,"props":3327,"children":3328},{"style":504},[3329],{"type":47,"value":539},{"type":42,"tag":491,"props":3331,"children":3332},{"style":510},[3333],{"type":47,"value":859},{"type":42,"tag":491,"props":3335,"children":3336},{"style":504},[3337],{"type":47,"value":549},{"type":42,"tag":50,"props":3339,"children":3340},{},[3341,3343,3349,3350,3356],{"type":47,"value":3342},"If ",{"type":42,"tag":220,"props":3344,"children":3346},{"className":3345},[],[3347],{"type":47,"value":3348},"license.status",{"type":47,"value":2739},{"type":42,"tag":220,"props":3351,"children":3353},{"className":3352},[],[3354],{"type":47,"value":3355},"\"expired\"",{"type":47,"value":3357},", proceed with recovery.",{"type":42,"tag":881,"props":3359,"children":3361},{"id":3360},"recovery-steps",[3362],{"type":47,"value":3363},"Recovery steps",{"type":42,"tag":50,"props":3365,"children":3366},{},[3367,3369,3373],{"type":47,"value":3368},"Follow the detailed recovery workflow in the ",{"type":42,"tag":61,"props":3370,"children":3371},{},[3372],{"type":47,"value":79},{"type":47,"value":3374}," skill. The critical first step depends on\ndeployment type:",{"type":42,"tag":176,"props":3376,"children":3377},{},[3378,3394],{"type":42,"tag":180,"props":3379,"children":3380},{},[3381],{"type":42,"tag":184,"props":3382,"children":3383},{},[3384,3389],{"type":42,"tag":188,"props":3385,"children":3386},{},[3387],{"type":47,"value":3388},"Deployment",{"type":42,"tag":188,"props":3390,"children":3391},{},[3392],{"type":47,"value":3393},"First step",{"type":42,"tag":199,"props":3395,"children":3396},{},[3397,3418,3431],{"type":42,"tag":184,"props":3398,"children":3399},{},[3400,3405],{"type":42,"tag":206,"props":3401,"children":3402},{},[3403],{"type":47,"value":3404},"Self-managed",{"type":42,"tag":206,"props":3406,"children":3407},{},[3408,3410,3416],{"type":47,"value":3409},"Log in with a file-based user (",{"type":42,"tag":220,"props":3411,"children":3413},{"className":3412},[],[3414],{"type":47,"value":3415},"elasticsearch-users",{"type":47,"value":3417}," CLI) or native user.",{"type":42,"tag":184,"props":3419,"children":3420},{},[3421,3426],{"type":42,"tag":206,"props":3422,"children":3423},{},[3424],{"type":47,"value":3425},"ECH",{"type":42,"tag":206,"props":3427,"children":3428},{},[3429],{"type":47,"value":3430},"Contact Elastic support or renew via the Cloud console.",{"type":42,"tag":184,"props":3432,"children":3433},{},[3434,3439],{"type":42,"tag":206,"props":3435,"children":3436},{},[3437],{"type":47,"value":3438},"Serverless",{"type":42,"tag":206,"props":3440,"children":3441},{},[3442],{"type":47,"value":3443},"Not applicable — licensing is fully managed by Elastic.",{"type":42,"tag":118,"props":3445,"children":3447},{"id":3446},"examples",[3448],{"type":47,"value":3449},"Examples",{"type":42,"tag":881,"props":3451,"children":3453},{"id":3452},"user-gets-403-when-querying-logs",[3454],{"type":47,"value":3455},"User gets 403 when querying logs",{"type":42,"tag":50,"props":3457,"children":3458},{},[3459,3464,3466,3472],{"type":42,"tag":61,"props":3460,"children":3461},{},[3462],{"type":47,"value":3463},"Symptom:",{"type":47,"value":3465}," \"I get a 403 when searching ",{"type":42,"tag":220,"props":3467,"children":3469},{"className":3468},[],[3470],{"type":47,"value":3471},"logs-*",{"type":47,"value":3473},".\"",{"type":42,"tag":3475,"props":3476,"children":3477},"ol",{},[3478],{"type":42,"tag":129,"props":3479,"children":3480},{},[3481],{"type":47,"value":3482},"Verify identity:",{"type":42,"tag":480,"props":3484,"children":3486},{"className":482,"code":3485,"language":484,"meta":485,"style":485},"curl -u \"joe:${PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n",[3487],{"type":42,"tag":220,"props":3488,"children":3489},{"__ignoreMap":485},[3490],{"type":42,"tag":491,"props":3491,"children":3492},{"class":493,"line":494},[3493,3497,3502,3506,3511,3515,3520,3524,3528,3532,3536,3540],{"type":42,"tag":491,"props":3494,"children":3495},{"style":498},[3496],{"type":47,"value":501},{"type":42,"tag":491,"props":3498,"children":3499},{"style":510},[3500],{"type":47,"value":3501}," -u",{"type":42,"tag":491,"props":3503,"children":3504},{"style":504},[3505],{"type":47,"value":708},{"type":42,"tag":491,"props":3507,"children":3508},{"style":510},[3509],{"type":47,"value":3510},"joe:",{"type":42,"tag":491,"props":3512,"children":3513},{"style":504},[3514],{"type":47,"value":1802},{"type":42,"tag":491,"props":3516,"children":3517},{"style":516},[3518],{"type":47,"value":3519},"PASSWORD",{"type":42,"tag":491,"props":3521,"children":3522},{"style":504},[3523],{"type":47,"value":1788},{"type":42,"tag":491,"props":3525,"children":3526},{"style":504},[3527],{"type":47,"value":529},{"type":42,"tag":491,"props":3529,"children":3530},{"style":516},[3531],{"type":47,"value":534},{"type":42,"tag":491,"props":3533,"children":3534},{"style":504},[3535],{"type":47,"value":539},{"type":42,"tag":491,"props":3537,"children":3538},{"style":510},[3539],{"type":47,"value":544},{"type":42,"tag":491,"props":3541,"children":3542},{"style":504},[3543],{"type":47,"value":549},{"type":42,"tag":50,"props":3545,"children":3546},{},[3547,3549,3555],{"type":47,"value":3548},"Response shows ",{"type":42,"tag":220,"props":3550,"children":3552},{"className":3551},[],[3553],{"type":47,"value":3554},"\"roles\": [\"viewer\"]",{"type":47,"value":94},{"type":42,"tag":3475,"props":3557,"children":3558},{},[3559],{"type":42,"tag":129,"props":3560,"children":3561},{},[3562],{"type":47,"value":3563},"Test privileges:",{"type":42,"tag":480,"props":3565,"children":3567},{"className":482,"code":3566,"language":484,"meta":485,"style":485},"curl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F_has_privileges\" \\\n  -u \"joe:${PASSWORD}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"index\": [{\"names\": [\"logs-*\"], \"privileges\": [\"read\"]}]}'\n",[3568],{"type":42,"tag":220,"props":3569,"children":3570},{"__ignoreMap":485},[3571,3610,3642,3665],{"type":42,"tag":491,"props":3572,"children":3573},{"class":493,"line":494},[3574,3578,3582,3586,3590,3594,3598,3602,3606],{"type":42,"tag":491,"props":3575,"children":3576},{"style":498},[3577],{"type":47,"value":501},{"type":42,"tag":491,"props":3579,"children":3580},{"style":510},[3581],{"type":47,"value":637},{"type":42,"tag":491,"props":3583,"children":3584},{"style":510},[3585],{"type":47,"value":642},{"type":42,"tag":491,"props":3587,"children":3588},{"style":504},[3589],{"type":47,"value":529},{"type":42,"tag":491,"props":3591,"children":3592},{"style":516},[3593],{"type":47,"value":534},{"type":42,"tag":491,"props":3595,"children":3596},{"style":504},[3597],{"type":47,"value":539},{"type":42,"tag":491,"props":3599,"children":3600},{"style":510},[3601],{"type":47,"value":659},{"type":42,"tag":491,"props":3603,"children":3604},{"style":504},[3605],{"type":47,"value":664},{"type":42,"tag":491,"props":3607,"children":3608},{"style":516},[3609],{"type":47,"value":669},{"type":42,"tag":491,"props":3611,"children":3612},{"class":493,"line":672},[3613,3618,3622,3626,3630,3634,3638],{"type":42,"tag":491,"props":3614,"children":3615},{"style":510},[3616],{"type":47,"value":3617},"  -u",{"type":42,"tag":491,"props":3619,"children":3620},{"style":504},[3621],{"type":47,"value":708},{"type":42,"tag":491,"props":3623,"children":3624},{"style":510},[3625],{"type":47,"value":3510},{"type":42,"tag":491,"props":3627,"children":3628},{"style":504},[3629],{"type":47,"value":1802},{"type":42,"tag":491,"props":3631,"children":3632},{"style":516},[3633],{"type":47,"value":3519},{"type":42,"tag":491,"props":3635,"children":3636},{"style":504},[3637],{"type":47,"value":1788},{"type":42,"tag":491,"props":3639,"children":3640},{"style":516},[3641],{"type":47,"value":669},{"type":42,"tag":491,"props":3643,"children":3644},{"class":493,"line":697},[3645,3649,3653,3657,3661],{"type":42,"tag":491,"props":3646,"children":3647},{"style":510},[3648],{"type":47,"value":703},{"type":42,"tag":491,"props":3650,"children":3651},{"style":504},[3652],{"type":47,"value":708},{"type":42,"tag":491,"props":3654,"children":3655},{"style":510},[3656],{"type":47,"value":713},{"type":42,"tag":491,"props":3658,"children":3659},{"style":504},[3660],{"type":47,"value":664},{"type":42,"tag":491,"props":3662,"children":3663},{"style":516},[3664],{"type":47,"value":669},{"type":42,"tag":491,"props":3666,"children":3667},{"class":493,"line":724},[3668,3672,3676,3681],{"type":42,"tag":491,"props":3669,"children":3670},{"style":510},[3671],{"type":47,"value":730},{"type":42,"tag":491,"props":3673,"children":3674},{"style":504},[3675],{"type":47,"value":735},{"type":42,"tag":491,"props":3677,"children":3678},{"style":510},[3679],{"type":47,"value":3680},"{\"index\": [{\"names\": [\"logs-*\"], \"privileges\": [\"read\"]}]}",{"type":42,"tag":491,"props":3682,"children":3683},{"style":504},[3684],{"type":47,"value":801},{"type":42,"tag":50,"props":3686,"children":3687},{},[3688,3690,3696,3698,3704,3706,3712,3714,3719],{"type":47,"value":3689},"Response: ",{"type":42,"tag":220,"props":3691,"children":3693},{"className":3692},[],[3694],{"type":47,"value":3695},"\"has_all_requested\": false",{"type":47,"value":3697}," — the ",{"type":42,"tag":220,"props":3699,"children":3701},{"className":3700},[],[3702],{"type":47,"value":3703},"viewer",{"type":47,"value":3705}," role does not include ",{"type":42,"tag":220,"props":3707,"children":3709},{"className":3708},[],[3710],{"type":47,"value":3711},"read",{"type":47,"value":3713}," on ",{"type":42,"tag":220,"props":3715,"children":3717},{"className":3716},[],[3718],{"type":47,"value":3471},{"type":47,"value":94},{"type":42,"tag":3475,"props":3721,"children":3722},{},[3723],{"type":42,"tag":129,"props":3724,"children":3725},{},[3726,3728,3734,3736,3740],{"type":47,"value":3727},"Fix: create a ",{"type":42,"tag":220,"props":3729,"children":3731},{"className":3730},[],[3732],{"type":47,"value":3733},"logs-reader",{"type":47,"value":3735}," role and assign it to Joe. See ",{"type":42,"tag":61,"props":3737,"children":3738},{},[3739],{"type":47,"value":72},{"type":47,"value":94},{"type":42,"tag":881,"props":3742,"children":3744},{"id":3743},"api-key-stopped-working",[3745],{"type":47,"value":3746},"API key stopped working",{"type":42,"tag":50,"props":3748,"children":3749},{},[3750,3754],{"type":42,"tag":61,"props":3751,"children":3752},{},[3753],{"type":47,"value":3463},{"type":47,"value":3755}," \"My API key returns 401 since yesterday.\"",{"type":42,"tag":3475,"props":3757,"children":3758},{},[3759],{"type":42,"tag":129,"props":3760,"children":3761},{},[3762],{"type":47,"value":3763},"Check the key:",{"type":42,"tag":480,"props":3765,"children":3767},{"className":482,"code":3766,"language":484,"meta":485,"style":485},"curl -u \"admin:${PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002Fapi_key?name=my-key\"\n",[3768],{"type":42,"tag":220,"props":3769,"children":3770},{"__ignoreMap":485},[3771],{"type":42,"tag":491,"props":3772,"children":3773},{"class":493,"line":494},[3774,3778,3782,3786,3791,3795,3799,3803,3807,3811,3815,3820],{"type":42,"tag":491,"props":3775,"children":3776},{"style":498},[3777],{"type":47,"value":501},{"type":42,"tag":491,"props":3779,"children":3780},{"style":510},[3781],{"type":47,"value":3501},{"type":42,"tag":491,"props":3783,"children":3784},{"style":504},[3785],{"type":47,"value":708},{"type":42,"tag":491,"props":3787,"children":3788},{"style":510},[3789],{"type":47,"value":3790},"admin:",{"type":42,"tag":491,"props":3792,"children":3793},{"style":504},[3794],{"type":47,"value":1802},{"type":42,"tag":491,"props":3796,"children":3797},{"style":516},[3798],{"type":47,"value":3519},{"type":42,"tag":491,"props":3800,"children":3801},{"style":504},[3802],{"type":47,"value":1788},{"type":42,"tag":491,"props":3804,"children":3805},{"style":504},[3806],{"type":47,"value":529},{"type":42,"tag":491,"props":3808,"children":3809},{"style":516},[3810],{"type":47,"value":534},{"type":42,"tag":491,"props":3812,"children":3813},{"style":504},[3814],{"type":47,"value":539},{"type":42,"tag":491,"props":3816,"children":3817},{"style":510},[3818],{"type":47,"value":3819},"\u002F_security\u002Fapi_key?name=my-key",{"type":42,"tag":491,"props":3821,"children":3822},{"style":504},[3823],{"type":47,"value":549},{"type":42,"tag":50,"props":3825,"children":3826},{},[3827,3828,3834],{"type":47,"value":3548},{"type":42,"tag":220,"props":3829,"children":3831},{"className":3830},[],[3832],{"type":47,"value":3833},"\"expiration\": 1709251200000",{"type":47,"value":3835}," — the key expired.",{"type":42,"tag":3475,"props":3837,"children":3838},{},[3839],{"type":42,"tag":129,"props":3840,"children":3841},{},[3842,3844,3849,3850,3854],{"type":47,"value":3843},"Fix: create a new API key with a suitable ",{"type":42,"tag":220,"props":3845,"children":3847},{"className":3846},[],[3848],{"type":47,"value":2286},{"type":47,"value":1182},{"type":42,"tag":61,"props":3851,"children":3852},{},[3853],{"type":47,"value":65},{"type":47,"value":94},{"type":42,"tag":881,"props":3856,"children":3858},{"id":3857},"saml-login-redirects-to-error",[3859],{"type":47,"value":3860},"SAML login redirects to error",{"type":42,"tag":50,"props":3862,"children":3863},{},[3864,3868],{"type":42,"tag":61,"props":3865,"children":3866},{},[3867],{"type":47,"value":3463},{"type":47,"value":3869}," \"Clicking the SSO button in Kibana redirects to an error page.\"",{"type":42,"tag":3475,"props":3871,"children":3872},{},[3873],{"type":42,"tag":129,"props":3874,"children":3875},{},[3876],{"type":47,"value":3877},"Check if the SAML realm is reachable by authenticating with a non-SAML method:",{"type":42,"tag":480,"props":3879,"children":3881},{"className":482,"code":3880,"language":484,"meta":485,"style":485},"curl -u \"elastic:${PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_security\u002F_authenticate\"\n",[3882],{"type":42,"tag":220,"props":3883,"children":3884},{"__ignoreMap":485},[3885],{"type":42,"tag":491,"props":3886,"children":3887},{"class":493,"line":494},[3888,3892,3896,3900,3905,3909,3913,3917,3921,3925,3929,3933],{"type":42,"tag":491,"props":3889,"children":3890},{"style":498},[3891],{"type":47,"value":501},{"type":42,"tag":491,"props":3893,"children":3894},{"style":510},[3895],{"type":47,"value":3501},{"type":42,"tag":491,"props":3897,"children":3898},{"style":504},[3899],{"type":47,"value":708},{"type":42,"tag":491,"props":3901,"children":3902},{"style":510},[3903],{"type":47,"value":3904},"elastic:",{"type":42,"tag":491,"props":3906,"children":3907},{"style":504},[3908],{"type":47,"value":1802},{"type":42,"tag":491,"props":3910,"children":3911},{"style":516},[3912],{"type":47,"value":3519},{"type":42,"tag":491,"props":3914,"children":3915},{"style":504},[3916],{"type":47,"value":1788},{"type":42,"tag":491,"props":3918,"children":3919},{"style":504},[3920],{"type":47,"value":529},{"type":42,"tag":491,"props":3922,"children":3923},{"style":516},[3924],{"type":47,"value":534},{"type":42,"tag":491,"props":3926,"children":3927},{"style":504},[3928],{"type":47,"value":539},{"type":42,"tag":491,"props":3930,"children":3931},{"style":510},[3932],{"type":47,"value":544},{"type":42,"tag":491,"props":3934,"children":3935},{"style":504},[3936],{"type":47,"value":549},{"type":42,"tag":3475,"props":3938,"children":3939},{},[3940],{"type":42,"tag":129,"props":3941,"children":3942},{},[3943],{"type":47,"value":3944},"Verify the IdP metadata URL is accessible from the Elasticsearch nodes (self-managed):",{"type":42,"tag":480,"props":3946,"children":3948},{"className":482,"code":3947,"language":484,"meta":485,"style":485},"curl -s \"${IDP_METADATA_URL}\" | head -5\n",[3949],{"type":42,"tag":220,"props":3950,"children":3951},{"__ignoreMap":485},[3952],{"type":42,"tag":491,"props":3953,"children":3954},{"class":493,"line":494},[3955,3959,3964,3968,3973,3977,3981,3985],{"type":42,"tag":491,"props":3956,"children":3957},{"style":498},[3958],{"type":47,"value":501},{"type":42,"tag":491,"props":3960,"children":3961},{"style":510},[3962],{"type":47,"value":3963}," -s",{"type":42,"tag":491,"props":3965,"children":3966},{"style":504},[3967],{"type":47,"value":529},{"type":42,"tag":491,"props":3969,"children":3970},{"style":516},[3971],{"type":47,"value":3972},"IDP_METADATA_URL",{"type":42,"tag":491,"props":3974,"children":3975},{"style":504},[3976],{"type":47,"value":1788},{"type":42,"tag":491,"props":3978,"children":3979},{"style":504},[3980],{"type":47,"value":1830},{"type":42,"tag":491,"props":3982,"children":3983},{"style":498},[3984],{"type":47,"value":1835},{"type":42,"tag":491,"props":3986,"children":3987},{"style":510},[3988],{"type":47,"value":3989}," -5\n",{"type":42,"tag":3475,"props":3991,"children":3992},{},[3993,3998],{"type":42,"tag":129,"props":3994,"children":3995},{},[3996],{"type":47,"value":3997},"Check for clock skew — SAML assertions are time-sensitive. Ensure NTP is configured on all nodes.",{"type":42,"tag":129,"props":3999,"children":4000},{},[4001,4003,4008,4009,4014],{"type":47,"value":4002},"Verify ",{"type":42,"tag":220,"props":4004,"children":4006},{"className":4005},[],[4007],{"type":47,"value":3146},{"type":47,"value":1247},{"type":42,"tag":220,"props":4010,"children":4012},{"className":4011},[],[4013],{"type":47,"value":3240},{"type":47,"value":4015}," matches the SAML ACS URL configured in the IdP.",{"type":42,"tag":881,"props":4017,"children":4019},{"id":4018},"users-locked-out-after-license-expired",[4020],{"type":47,"value":4021},"Users locked out after license expired",{"type":42,"tag":50,"props":4023,"children":4024},{},[4025,4029],{"type":42,"tag":61,"props":4026,"children":4027},{},[4028],{"type":47,"value":3463},{"type":47,"value":4030}," \"Nobody can log in to Kibana. We use SAML.\"",{"type":42,"tag":3475,"props":4032,"children":4033},{},[4034],{"type":42,"tag":129,"props":4035,"children":4036},{},[4037],{"type":47,"value":4038},"Check license:",{"type":42,"tag":480,"props":4040,"children":4042},{"className":482,"code":4041,"language":484,"meta":485,"style":485},"curl -u \"admin:${PASSWORD}\" \"${ELASTICSEARCH_URL}\u002F_license\"\n",[4043],{"type":42,"tag":220,"props":4044,"children":4045},{"__ignoreMap":485},[4046],{"type":42,"tag":491,"props":4047,"children":4048},{"class":493,"line":494},[4049,4053,4057,4061,4065,4069,4073,4077,4081,4085,4089,4093],{"type":42,"tag":491,"props":4050,"children":4051},{"style":498},[4052],{"type":47,"value":501},{"type":42,"tag":491,"props":4054,"children":4055},{"style":510},[4056],{"type":47,"value":3501},{"type":42,"tag":491,"props":4058,"children":4059},{"style":504},[4060],{"type":47,"value":708},{"type":42,"tag":491,"props":4062,"children":4063},{"style":510},[4064],{"type":47,"value":3790},{"type":42,"tag":491,"props":4066,"children":4067},{"style":504},[4068],{"type":47,"value":1802},{"type":42,"tag":491,"props":4070,"children":4071},{"style":516},[4072],{"type":47,"value":3519},{"type":42,"tag":491,"props":4074,"children":4075},{"style":504},[4076],{"type":47,"value":1788},{"type":42,"tag":491,"props":4078,"children":4079},{"style":504},[4080],{"type":47,"value":529},{"type":42,"tag":491,"props":4082,"children":4083},{"style":516},[4084],{"type":47,"value":534},{"type":42,"tag":491,"props":4086,"children":4087},{"style":504},[4088],{"type":47,"value":539},{"type":42,"tag":491,"props":4090,"children":4091},{"style":510},[4092],{"type":47,"value":859},{"type":42,"tag":491,"props":4094,"children":4095},{"style":504},[4096],{"type":47,"value":549},{"type":42,"tag":50,"props":4098,"children":4099},{},[4100,4101,4107,4108,4114],{"type":47,"value":3548},{"type":42,"tag":220,"props":4102,"children":4104},{"className":4103},[],[4105],{"type":47,"value":4106},"\"status\": \"expired\"",{"type":47,"value":2288},{"type":42,"tag":220,"props":4109,"children":4111},{"className":4110},[],[4112],{"type":47,"value":4113},"\"type\": \"platinum\"",{"type":47,"value":94},{"type":42,"tag":3475,"props":4116,"children":4117},{},[4118],{"type":42,"tag":129,"props":4119,"children":4120},{},[4121,4123,4127],{"type":47,"value":4122},"The SAML realm is disabled because the paid license expired. Follow the recovery steps in ",{"type":42,"tag":61,"props":4124,"children":4125},{},[4126],{"type":47,"value":79},{"type":47,"value":4128},":\nlog in with a file-based or native user, then upload a renewed license or revert to basic.",{"type":42,"tag":118,"props":4130,"children":4132},{"id":4131},"guidelines",[4133],{"type":47,"value":4134},"Guidelines",{"type":42,"tag":881,"props":4136,"children":4138},{"id":4137},"always-start-with-_authenticate",[4139,4141],{"type":47,"value":4140},"Always start with ",{"type":42,"tag":220,"props":4142,"children":4144},{"className":4143},[],[4145],{"type":47,"value":2783},{"type":42,"tag":50,"props":4147,"children":4148},{},[4149,4151,4157],{"type":47,"value":4150},"Run ",{"type":42,"tag":220,"props":4152,"children":4154},{"className":4153},[],[4155],{"type":47,"value":4156},"GET \u002F_security\u002F_authenticate",{"type":47,"value":4158}," as the first diagnostic step. It reveals the user's identity, realm, roles, and\nauthentication type in a single call. Most issues become apparent from this response alone.",{"type":42,"tag":881,"props":4160,"children":4162},{"id":4161},"check-the-license-early",[4163],{"type":47,"value":4164},"Check the license early",{"type":42,"tag":50,"props":4166,"children":4167},{},[4168,4170,4176],{"type":47,"value":4169},"Before investigating realm or privilege issues, verify the license is active with ",{"type":42,"tag":220,"props":4171,"children":4173},{"className":4172},[],[4174],{"type":47,"value":4175},"GET \u002F_license",{"type":47,"value":4177},". An expired paid\nlicense disables realms and features, producing symptoms that mimic misconfiguration.",{"type":42,"tag":881,"props":4179,"children":4181},{"id":4180},"use-_has_privileges-before-manual-inspection",[4182,4183,4189],{"type":47,"value":2174},{"type":42,"tag":220,"props":4184,"children":4186},{"className":4185},[],[4187],{"type":47,"value":4188},"_has_privileges",{"type":47,"value":4190}," before manual inspection",{"type":42,"tag":50,"props":4192,"children":4193},{},[4194,4196,4202],{"type":47,"value":4195},"Instead of reading role definitions and mentally computing effective access, use ",{"type":42,"tag":220,"props":4197,"children":4199},{"className":4198},[],[4200],{"type":47,"value":4201},"POST \u002F_security\u002Fuser\u002F_has_privileges",{"type":47,"value":4203},"\nto test specific privileges directly. This is faster and accounts for role composition, DLS, and FLS.",{"type":42,"tag":881,"props":4205,"children":4207},{"id":4206},"avoid-superuser-credentials",[4208],{"type":47,"value":4209},"Avoid superuser credentials",{"type":42,"tag":50,"props":4211,"children":4212},{},[4213,4215,4220,4222,4227,4229,4234],{"type":47,"value":4214},"Never use the built-in ",{"type":42,"tag":220,"props":4216,"children":4218},{"className":4217},[],[4219],{"type":47,"value":8},{"type":47,"value":4221}," superuser for day-to-day troubleshooting. Create a dedicated admin user or API key with\n",{"type":42,"tag":220,"props":4223,"children":4225},{"className":4224},[],[4226],{"type":47,"value":271},{"type":47,"value":4228}," privileges. Reserve the ",{"type":42,"tag":220,"props":4230,"children":4232},{"className":4231},[],[4233],{"type":47,"value":8},{"type":47,"value":4235}," user for initial setup and emergency recovery only.",{"type":42,"tag":881,"props":4237,"children":4239},{"id":4238},"do-not-bypass-tls-in-production",[4240],{"type":47,"value":4241},"Do not bypass TLS in production",{"type":42,"tag":50,"props":4243,"children":4244},{},[4245,4247,4252,4253,4258],{"type":47,"value":4246},"Using ",{"type":42,"tag":220,"props":4248,"children":4250},{"className":4249},[],[4251],{"type":47,"value":2180},{"type":47,"value":286},{"type":42,"tag":220,"props":4254,"children":4256},{"className":4255},[],[4257],{"type":47,"value":2188},{"type":47,"value":4259}," skips certificate verification and masks real TLS issues. Use it only for initial\ndiagnosis, then fix the underlying certificate problem.",{"type":42,"tag":118,"props":4261,"children":4263},{"id":4262},"deployment-compatibility",[4264],{"type":47,"value":114},{"type":42,"tag":50,"props":4266,"children":4267},{},[4268],{"type":47,"value":4269},"Diagnostic tool and API availability differs across deployment types.",{"type":42,"tag":176,"props":4271,"children":4272},{},[4273,4296],{"type":42,"tag":180,"props":4274,"children":4275},{},[4276],{"type":42,"tag":184,"props":4277,"children":4278},{},[4279,4284,4288,4292],{"type":42,"tag":188,"props":4280,"children":4281},{},[4282],{"type":47,"value":4283},"Tool \u002F API",{"type":42,"tag":188,"props":4285,"children":4286},{},[4287],{"type":47,"value":3404},{"type":42,"tag":188,"props":4289,"children":4290},{},[4291],{"type":47,"value":3425},{"type":42,"tag":188,"props":4293,"children":4294},{},[4295],{"type":47,"value":3438},{"type":42,"tag":199,"props":4297,"children":4298},{},[4299,4324,4348,4373,4399,4425,4449,4474,4500],{"type":42,"tag":184,"props":4300,"children":4301},{},[4302,4311,4316,4320],{"type":42,"tag":206,"props":4303,"children":4304},{},[4305],{"type":42,"tag":220,"props":4306,"children":4308},{"className":4307},[],[4309],{"type":47,"value":4310},"_security\u002F_authenticate",{"type":42,"tag":206,"props":4312,"children":4313},{},[4314],{"type":47,"value":4315},"Yes",{"type":42,"tag":206,"props":4317,"children":4318},{},[4319],{"type":47,"value":4315},{"type":42,"tag":206,"props":4321,"children":4322},{},[4323],{"type":47,"value":4315},{"type":42,"tag":184,"props":4325,"children":4326},{},[4327,4336,4340,4344],{"type":42,"tag":206,"props":4328,"children":4329},{},[4330],{"type":42,"tag":220,"props":4331,"children":4333},{"className":4332},[],[4334],{"type":47,"value":4335},"_security\u002Fuser\u002F_has_privileges",{"type":42,"tag":206,"props":4337,"children":4338},{},[4339],{"type":47,"value":4315},{"type":42,"tag":206,"props":4341,"children":4342},{},[4343],{"type":47,"value":4315},{"type":42,"tag":206,"props":4345,"children":4346},{},[4347],{"type":47,"value":4315},{"type":42,"tag":184,"props":4349,"children":4350},{},[4351,4360,4364,4368],{"type":42,"tag":206,"props":4352,"children":4353},{},[4354],{"type":42,"tag":220,"props":4355,"children":4357},{"className":4356},[],[4358],{"type":47,"value":4359},"_xpack",{"type":42,"tag":206,"props":4361,"children":4362},{},[4363],{"type":47,"value":4315},{"type":42,"tag":206,"props":4365,"children":4366},{},[4367],{"type":47,"value":4315},{"type":42,"tag":206,"props":4369,"children":4370},{},[4371],{"type":47,"value":4372},"Limited",{"type":42,"tag":184,"props":4374,"children":4375},{},[4376,4385,4389,4394],{"type":42,"tag":206,"props":4377,"children":4378},{},[4379],{"type":42,"tag":220,"props":4380,"children":4382},{"className":4381},[],[4383],{"type":47,"value":4384},"_license",{"type":42,"tag":206,"props":4386,"children":4387},{},[4388],{"type":47,"value":4315},{"type":42,"tag":206,"props":4390,"children":4391},{},[4392],{"type":47,"value":4393},"Yes (read)",{"type":42,"tag":206,"props":4395,"children":4396},{},[4397],{"type":47,"value":4398},"Not available",{"type":42,"tag":184,"props":4400,"children":4401},{},[4402,4413,4417,4421],{"type":42,"tag":206,"props":4403,"children":4404},{},[4405,4411],{"type":42,"tag":220,"props":4406,"children":4408},{"className":4407},[],[4409],{"type":47,"value":4410},"_security\u002Fapi_key",{"type":47,"value":4412}," (GET)",{"type":42,"tag":206,"props":4414,"children":4415},{},[4416],{"type":47,"value":4315},{"type":42,"tag":206,"props":4418,"children":4419},{},[4420],{"type":47,"value":4315},{"type":42,"tag":206,"props":4422,"children":4423},{},[4424],{"type":47,"value":4315},{"type":42,"tag":184,"props":4426,"children":4427},{},[4428,4437,4441,4445],{"type":42,"tag":206,"props":4429,"children":4430},{},[4431],{"type":42,"tag":220,"props":4432,"children":4434},{"className":4433},[],[4435],{"type":47,"value":4436},"_security\u002Frole_mapping",{"type":42,"tag":206,"props":4438,"children":4439},{},[4440],{"type":47,"value":4315},{"type":42,"tag":206,"props":4442,"children":4443},{},[4444],{"type":47,"value":4315},{"type":42,"tag":206,"props":4446,"children":4447},{},[4448],{"type":47,"value":4315},{"type":42,"tag":184,"props":4450,"children":4451},{},[4452,4462,4466,4470],{"type":42,"tag":206,"props":4453,"children":4454},{},[4455,4460],{"type":42,"tag":220,"props":4456,"children":4458},{"className":4457},[],[4459],{"type":47,"value":3415},{"type":47,"value":4461}," CLI",{"type":42,"tag":206,"props":4463,"children":4464},{},[4465],{"type":47,"value":4315},{"type":42,"tag":206,"props":4467,"children":4468},{},[4469],{"type":47,"value":4398},{"type":42,"tag":206,"props":4471,"children":4472},{},[4473],{"type":47,"value":4398},{"type":42,"tag":184,"props":4475,"children":4476},{},[4477,4488,4492,4496],{"type":42,"tag":206,"props":4478,"children":4479},{},[4480,4486],{"type":42,"tag":220,"props":4481,"children":4483},{"className":4482},[],[4484],{"type":47,"value":4485},"openssl s_client",{"type":47,"value":4487}," on nodes",{"type":42,"tag":206,"props":4489,"children":4490},{},[4491],{"type":47,"value":4315},{"type":42,"tag":206,"props":4493,"children":4494},{},[4495],{"type":47,"value":4398},{"type":42,"tag":206,"props":4497,"children":4498},{},[4499],{"type":47,"value":4398},{"type":42,"tag":184,"props":4501,"children":4502},{},[4503,4508,4512,4517],{"type":42,"tag":206,"props":4504,"children":4505},{},[4506],{"type":47,"value":4507},"Elasticsearch logs",{"type":42,"tag":206,"props":4509,"children":4510},{},[4511],{"type":47,"value":4315},{"type":42,"tag":206,"props":4513,"children":4514},{},[4515],{"type":47,"value":4516},"Via Cloud UI",{"type":42,"tag":206,"props":4518,"children":4519},{},[4520],{"type":47,"value":4516},{"type":42,"tag":50,"props":4522,"children":4523},{},[4524],{"type":42,"tag":61,"props":4525,"children":4526},{},[4527],{"type":47,"value":4528},"ECH notes:",{"type":42,"tag":125,"props":4530,"children":4531},{},[4532,4544,4549],{"type":42,"tag":129,"props":4533,"children":4534},{},[4535,4537,4542],{"type":47,"value":4536},"No node-level access, so the ",{"type":42,"tag":220,"props":4538,"children":4540},{"className":4539},[],[4541],{"type":47,"value":3415},{"type":47,"value":4543}," CLI and direct log\u002Fcertificate inspection are not available.",{"type":42,"tag":129,"props":4545,"children":4546},{},[4547],{"type":47,"value":4548},"TLS is managed by Elastic — certificate errors typically indicate an incorrect endpoint URL.",{"type":42,"tag":129,"props":4550,"children":4551},{},[4552],{"type":47,"value":4553},"Use the Cloud console for log inspection and deployment configuration.",{"type":42,"tag":50,"props":4555,"children":4556},{},[4557],{"type":42,"tag":61,"props":4558,"children":4559},{},[4560],{"type":47,"value":4561},"Serverless notes:",{"type":42,"tag":125,"props":4563,"children":4564},{},[4565,4570,4575],{"type":42,"tag":129,"props":4566,"children":4567},{},[4568],{"type":47,"value":4569},"Licensing APIs are not exposed. License-related lockouts do not occur.",{"type":42,"tag":129,"props":4571,"children":4572},{},[4573],{"type":47,"value":4574},"Native users do not exist — authentication issues are handled at the organization level.",{"type":42,"tag":129,"props":4576,"children":4577},{},[4578],{"type":47,"value":4579},"TLS is fully managed and transparent.",{"type":42,"tag":4581,"props":4582,"children":4583},"style",{},[4584],{"type":47,"value":4585},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":4587,"total":4747},[4588,4607,4622,4635,4652,4663,4673,4686,4697,4712,4722,4734],{"slug":4589,"name":4589,"fn":4590,"description":4591,"org":4592,"tags":4593,"stars":4604,"repoUrl":4605,"updatedAt":4606},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4594,4597,4600,4601],{"name":4595,"slug":4596,"type":15},"Analytics","analytics",{"name":4598,"slug":4599,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":4602,"slug":4603,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":4608,"name":4608,"fn":4609,"description":4610,"org":4611,"tags":4612,"stars":4604,"repoUrl":4605,"updatedAt":4621},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4613,4614,4615,4618],{"name":21,"slug":22,"type":15},{"name":9,"slug":8,"type":15},{"name":4616,"slug":4617,"type":15},"Engineering","engineering",{"name":4619,"slug":4620,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":4623,"name":4623,"fn":4624,"description":4625,"org":4626,"tags":4627,"stars":4604,"repoUrl":4605,"updatedAt":4634},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4628,4629,4630,4631],{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},{"name":4602,"slug":4603,"type":15},{"name":4632,"slug":4633,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":4636,"name":4636,"fn":4637,"description":4638,"org":4639,"tags":4640,"stars":23,"repoUrl":24,"updatedAt":4651},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4641,4644,4645,4648],{"name":4642,"slug":4643,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":4646,"slug":4647,"type":15},"Operations","operations",{"name":4649,"slug":4650,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":4653,"name":4653,"fn":4654,"description":4655,"org":4656,"tags":4657,"stars":23,"repoUrl":24,"updatedAt":4662},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4658,4659,4661],{"name":4642,"slug":4643,"type":15},{"name":3388,"slug":4660,"type":15},"deployment",{"name":18,"slug":19,"type":15},"2026-07-12T07:46:42.353362",{"slug":4664,"name":4664,"fn":4665,"description":4666,"org":4667,"tags":4668,"stars":23,"repoUrl":24,"updatedAt":4672},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4669,4670,4671],{"name":4642,"slug":4643,"type":15},{"name":18,"slug":19,"type":15},{"name":4646,"slug":4647,"type":15},"2026-07-12T07:46:41.097412",{"slug":4674,"name":4674,"fn":4675,"description":4676,"org":4677,"tags":4678,"stars":23,"repoUrl":24,"updatedAt":4685},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4679,4680,4681,4684],{"name":4642,"slug":4643,"type":15},{"name":18,"slug":19,"type":15},{"name":4682,"slug":4683,"type":15},"Networking","networking",{"name":13,"slug":14,"type":15},"2026-07-12T07:46:43.675992",{"slug":4687,"name":4687,"fn":4688,"description":4689,"org":4690,"tags":4691,"stars":23,"repoUrl":24,"updatedAt":4696},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4692,4694,4695],{"name":238,"slug":4693,"type":15},"authentication",{"name":4642,"slug":4643,"type":15},{"name":18,"slug":19,"type":15},"2026-07-12T07:46:39.783105",{"slug":4698,"name":4698,"fn":4699,"description":4700,"org":4701,"tags":4702,"stars":23,"repoUrl":24,"updatedAt":4711},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4703,4706,4707,4710],{"name":4704,"slug":4705,"type":15},"Audit","audit",{"name":18,"slug":19,"type":15},{"name":4708,"slug":4709,"type":15},"Logs","logs",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:35.092599",{"slug":65,"name":65,"fn":4713,"description":4714,"org":4715,"tags":4716,"stars":23,"repoUrl":24,"updatedAt":4721},"configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4717,4718,4719,4720],{"name":238,"slug":4693,"type":15},{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:41.474547",{"slug":72,"name":72,"fn":4723,"description":4724,"org":4725,"tags":4726,"stars":23,"repoUrl":24,"updatedAt":4733},"manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4727,4728,4729,4732],{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},{"name":4730,"slug":4731,"type":15},"RBAC","rbac",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:36.394177",{"slug":4735,"name":4735,"fn":4736,"description":4737,"org":4738,"tags":4739,"stars":23,"repoUrl":24,"updatedAt":4746},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4740,4741,4742,4743],{"name":4595,"slug":4596,"type":15},{"name":4598,"slug":4599,"type":15},{"name":18,"slug":19,"type":15},{"name":4744,"slug":4745,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":4749,"total":4796},[4750,4757,4763,4769,4776,4782,4789],{"slug":4636,"name":4636,"fn":4637,"description":4638,"org":4751,"tags":4752,"stars":23,"repoUrl":24,"updatedAt":4651},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4753,4754,4755,4756],{"name":4642,"slug":4643,"type":15},{"name":9,"slug":8,"type":15},{"name":4646,"slug":4647,"type":15},{"name":4649,"slug":4650,"type":15},{"slug":4653,"name":4653,"fn":4654,"description":4655,"org":4758,"tags":4759,"stars":23,"repoUrl":24,"updatedAt":4662},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4760,4761,4762],{"name":4642,"slug":4643,"type":15},{"name":3388,"slug":4660,"type":15},{"name":18,"slug":19,"type":15},{"slug":4664,"name":4664,"fn":4665,"description":4666,"org":4764,"tags":4765,"stars":23,"repoUrl":24,"updatedAt":4672},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4766,4767,4768],{"name":4642,"slug":4643,"type":15},{"name":18,"slug":19,"type":15},{"name":4646,"slug":4647,"type":15},{"slug":4674,"name":4674,"fn":4675,"description":4676,"org":4770,"tags":4771,"stars":23,"repoUrl":24,"updatedAt":4685},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4772,4773,4774,4775],{"name":4642,"slug":4643,"type":15},{"name":18,"slug":19,"type":15},{"name":4682,"slug":4683,"type":15},{"name":13,"slug":14,"type":15},{"slug":4687,"name":4687,"fn":4688,"description":4689,"org":4777,"tags":4778,"stars":23,"repoUrl":24,"updatedAt":4696},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4779,4780,4781],{"name":238,"slug":4693,"type":15},{"name":4642,"slug":4643,"type":15},{"name":18,"slug":19,"type":15},{"slug":4698,"name":4698,"fn":4699,"description":4700,"org":4783,"tags":4784,"stars":23,"repoUrl":24,"updatedAt":4711},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4785,4786,4787,4788],{"name":4704,"slug":4705,"type":15},{"name":18,"slug":19,"type":15},{"name":4708,"slug":4709,"type":15},{"name":13,"slug":14,"type":15},{"slug":65,"name":65,"fn":4713,"description":4714,"org":4790,"tags":4791,"stars":23,"repoUrl":24,"updatedAt":4721},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4792,4793,4794,4795],{"name":238,"slug":4693,"type":15},{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},{"name":13,"slug":14,"type":15},35]