{"type":"log","@timestamp":"2025-06-24T14:50:24+08:00","tags":["info","plugins-system","standard"],"pid":479830,"message":"Stopping all plugins."} {"type":"log","@timestamp":"2025-06-24T14:50:36+08:00","tags":["info","plugins-service"],"pid":482777,"message":"Plugin \"metricsEntities\" is disabled."} {"type":"log","@timestamp":"2025-06-24T14:50:36+08:00","tags":["info","http","server","Preboot"],"pid":482777,"message":"http server running at http://0.0.0.0:5601"} {"type":"log","@timestamp":"2025-06-24T14:50:36+08:00","tags":["warning","config","deprecation"],"pid":482777,"message":"“logging.dest”已过时,将在 8.0 中移除。要设置目标前移,可以在日志记录配置中使用“console”追加器,或定义定制追加器。"} {"type":"log","@timestamp":"2025-06-24T14:50:36+08:00","tags":["warning","config","deprecation"],"pid":482777,"message":"Starting in 8.0, the Kibana logging format will be changing. This may affect you if you are doing any special handling of your Kibana logs, such as ingesting logs into Elasticsearch for further analysis. If you are using the new logging configuration, you are already receiving logs in both old and new formats, and the old format will simply be going away. If you are not yet using the new logging configuration, the log format will change upon upgrade to 8.0. Beginning in 8.0, the format of JSON logs will be ECS-compatible JSON, and the default pattern log format will be configurable with our new logging system. Please refer to the documentation for more information about the new logging format."} {"type":"log","@timestamp":"2025-06-24T14:50:36+08:00","tags":["warning","config","deprecation"],"pid":482777,"message":"The default mechanism for Reporting privileges will work differently in future versions, which will affect the behavior of this cluster. Set \"xpack.reporting.roles.enabled\" to \"false\" to adopt the future behavior before upgrading."} {"type":"log","@timestamp":"2025-06-24T14:50:36+08:00","tags":["warning","config","deprecation"],"pid":482777,"message":"从 8.0 开始,用户会话将在处于非活动状态 8 小时后自动超时。覆盖此值以更改超时。"} {"type":"log","@timestamp":"2025-06-24T14:50:36+08:00","tags":["warning","config","deprecation"],"pid":482777,"message":"从 8.0 开始,将在 30 天后自动要求用户重新登录。覆盖此值以更改超时。"} {"type":"log","@timestamp":"2025-06-24T14:50:37+08:00","tags":["info","plugins-system","standard"],"pid":482777,"message":"Setting up [113] plugins: [translations,licensing,globalSearch,globalSearchProviders,features,licenseApiGuard,code,usageCollection,xpackLegacy,taskManager,telemetryCollectionManager,telemetryCollectionXpack,kibanaUsageCollection,share,embeddable,uiActionsEnhanced,screenshotMode,banners,telemetry,newsfeed,mapsEms,mapsLegacy,kibanaLegacy,fieldFormats,expressions,dataViews,charts,esUiShared,bfetch,data,savedObjects,presentationUtil,expressionShape,expressionRevealImage,expressionRepeatImage,expressionMetric,expressionImage,customIntegrations,home,searchprofiler,painlessLab,grokdebugger,management,watcher,licenseManagement,advancedSettings,spaces,security,savedObjectsTagging,reporting,canvas,lists,ingestPipelines,fileUpload,encryptedSavedObjects,dataEnhanced,cloud,snapshotRestore,eventLog,actions,alerting,triggersActionsUi,transform,stackAlerts,ruleRegistry,visualizations,visTypeXy,visTypeVislib,visTypeVega,visTypeTimelion,visTypeTagcloud,visTypeTable,visTypePie,visTypeMetric,visTypeMarkdown,tileMap,regionMap,expressionTagcloud,expressionMetricVis,console,graph,fleet,indexManagement,remoteClusters,crossClusterReplication,indexLifecycleManagement,dashboard,maps,dashboardMode,dashboardEnhanced,visualize,visTypeTimeseries,rollup,indexPatternFieldEditor,lens,cases,timelines,discover,osquery,observability,discoverEnhanced,dataVisualizer,ml,uptime,securitySolution,infra,upgradeAssistant,monitoring,logstash,enterpriseSearch,apm,savedObjectsManagement,indexPatternManagement]"} {"type":"log","@timestamp":"2025-06-24T14:50:37+08:00","tags":["info","plugins","taskManager"],"pid":482777,"message":"TaskManager is identified by the Kibana UUID: 77d9d0a0-6e2c-40b8-88ac-fc11ac026f06"} {"type":"log","@timestamp":"2025-06-24T14:50:37+08:00","tags":["warning","plugins","security","config"],"pid":482777,"message":"Generating a random key for xpack.security.encryptionKey. To prevent sessions from being invalidated on restart, please set xpack.security.encryptionKey in the kibana.yml or use the bin/kibana-encryption-keys command."} {"type":"log","@timestamp":"2025-06-24T14:50:37+08:00","tags":["warning","plugins","security","config"],"pid":482777,"message":"Session cookies will be transmitted over insecure connections. This is not recommended."} {"type":"log","@timestamp":"2025-06-24T14:50:37+08:00","tags":["warning","plugins","security","config"],"pid":482777,"message":"Generating a random key for xpack.security.encryptionKey. To prevent sessions from being invalidated on restart, please set xpack.security.encryptionKey in the kibana.yml or use the bin/kibana-encryption-keys command."} {"type":"log","@timestamp":"2025-06-24T14:50:37+08:00","tags":["warning","plugins","security","config"],"pid":482777,"message":"Session cookies will be transmitted over insecure connections. This is not recommended."} {"type":"log","@timestamp":"2025-06-24T14:50:37+08:00","tags":["warning","plugins","reporting","config"],"pid":482777,"message":"为 xpack.reporting.encryptionKey 生成随机密钥。为防止会话在重启时失效,请在 kibana.yml 中设置 xpack.reporting.encryptionKey 或使用 bin/kibana-encryption-keys 命令。"} {"type":"log","@timestamp":"2025-06-24T14:50:37+08:00","tags":["info","plugins","encryptedSavedObjects"],"pid":482777,"message":"Hashed 'xpack.encryptedSavedObjects.encryptionKey' for this instance: BQrB8dUsBGlAaZ1eq5SwFcYUCjFJrtTroWs/ofYlvTs="} {"type":"log","@timestamp":"2025-06-24T14:50:37+08:00","tags":["info","plugins","ruleRegistry"],"pid":482777,"message":"Installing common resources shared between all indices"} {"type":"log","@timestamp":"2025-06-24T14:50:38+08:00","tags":["info","plugins","reporting","config"],"pid":482777,"message":"Chromium 沙盒提供附加保护层,受 Linux Ubuntu OS 支持。自动启用 Chromium 沙盒。"} {"type":"log","@timestamp":"2025-06-24T14:50:38+08:00","tags":["warning","process"],"pid":482777,"message":"Error [ProductNotSupportedSecurityError]: The client is unable to verify that the server is Elasticsearch due to security privileges on the server side. Some functionality may not be compatible if the server is running an unsupported product.\n at /hatech/kibana-7.17.9-linux-aarch64/node_modules/@elastic/elasticsearch/lib/Transport.js:576:19\n at onBody (/hatech/kibana-7.17.9-linux-aarch64/node_modules/@elastic/elasticsearch/lib/Transport.js:369:9)\n at IncomingMessage.onEnd (/hatech/kibana-7.17.9-linux-aarch64/node_modules/@elastic/elasticsearch/lib/Transport.js:291:11)\n at IncomingMessage.emit (node:events:525:35)\n at endReadableNT (node:internal/streams/readable:1358:12)\n at processTicksAndRejections (node:internal/process/task_queues:83:21)"} {"type":"log","@timestamp":"2025-06-24T14:50:38+08:00","tags":["error","elasticsearch-service"],"pid":482777,"message":"Unable to retrieve version information from Elasticsearch nodes. security_exception: [security_exception] Reason: unable to authenticate user [efk] for REST request [/_nodes?filter_path=nodes.*.version%2Cnodes.*.http.publish_address%2Cnodes.*.ip]"} 解决此问题
时间: 2025-06-30 12:10:04 浏览: 18
<think>我们正在处理一个关于Kibana启动后无法验证Elasticsearch身份导致功能异常的问题。具体错误是“ProductNotSupportedSecurityError:unabletoverifyElasticsearchserverduetosecurityprivileges”。根据引用内容,我们可以推断这个问题与Elasticsearch的安全配置有关。分析引用:引用[1]提到:Failedtoauthenticateuser'elastic'...可能的原因包括:'elastic'用户的密码已经被更改,或者Elasticsearch节点运行在不同的密钥库上。引用[2]提到:启用Elasticsearch安全功能后,用户必须使用有效的用户名和密码登录Kibana。配置Kibana使用内置的kibana_system用户和密码,然后以elastic超级用户登录Kibana。因此,问题很可能出在Kibana连接Elasticsearch时使用的凭证(kibana_system用户)不正确或未正确配置。解决方案步骤:1.确认Elasticsearch的安全功能已启用,并且kibana_system用户的密码已知。-在Elasticsearch中,内置用户包括elastic和kibana_system等。kibana_system用户是Kibana用来连接Elasticsearch的,而elastic是超级用户。-如果忘记了kibana_system用户的密码,可以通过Elasticsearch的resetpasswordAPI重置。2.配置Kibana使用正确的kibana_system用户凭证。-修改Kibana的配置文件(kibana.yml),设置以下参数:elasticsearch.username:"kibana_system"elasticsearch.password:"你的kibana_system用户的密码"3.如果上述配置已经正确,但仍然出现错误,则检查Elasticsearch和Kibana的版本兼容性。错误中提到的“ProductNotSupportedSecurityError”也可能是因为版本不匹配。4.另外,确保Kibana能够访问Elasticsearch的9200端口,并且网络连接正常。5.如果问题仍然存在,可以尝试重置kibana_system用户的密码,并更新Kibana配置。重置kibana_system用户密码的方法(在Elasticsearch节点上运行):使用elastic用户(超级用户)通过以下命令重置:```bashcurl-XPOST-uelastic"localhost:9200/_security/user/kibana_system/_password?pretty"-H'Content-Type:application/json'-d'{"password":"new_password"}'```6.更新Kibana配置后,重启Kibana服务。7.如果问题仍未解决,检查Elasticsearch的日志和Kibana的日志,寻找更多线索。根据引用[3]中的运维工具箱,我们可以使用ELKStack(即Elasticsearch、Logstash、Kibana)自身的日志功能来分析问题。查看Kibana日志(通常位于/var/log/kibana/)和Elasticsearch日志(通常位于/var/log/elasticsearch/)以获取更详细的错误信息。注意:在修改配置后,需要重启Kibana服务。总结:主要步骤是确认并配置正确的kibana_system用户密码,并确保网络和版本兼容性。生成相关问题:1.如何重置Elasticsearch内置用户的密码?2.如何启用Elasticsearch的安全功能?3.Kibana和Elasticsearch的版本兼容性如何检查?</think>### Kibana Error "ProductNotSupportedSecurityError" 解决方案
此错误表明 Kibana 无法验证 Elasticsearch 的安全凭证,导致功能异常。核心原因是 Kibana 连接 Elasticsearch 时使用的安全凭证权限不足或配置错误。以下是系统化解决方案:
#### 1. **验证 Elasticsearch 安全配置**
```bash
# 检查安全功能状态
curl -u elastic -XGET http://localhost:9200/_security/_enabled?pretty
```
- 若返回 `"enabled": true` 表示安全功能已启用[^2]
- 若未启用,在 `elasticsearch.yml` 添加:
```yaml
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
```
#### 2. **重置 kibana_system 用户密码**
```bash
# 使用 elastic 超级用户重置密码
curl -u elastic -XPOST "http://localhost:9200/_security/user/kibana_system/_password" -H 'Content-Type: application/json' -d'
{
"password": "YourNewSecurePassword"
}
```
> 此操作需在 Elasticsearch 节点执行[^2]
#### 3. **更新 Kibana 配置文件**
修改 `kibana.yml`:
```yaml
elasticsearch.username: "kibana_system"
elasticsearch.password: "YourNewSecurePassword"
elasticsearch.ssl.verificationMode: none # 测试环境临时禁用SSL验证
```
#### 4. **检查密钥库一致性**
- 确认所有节点使用相同密钥库路径:`/etc/elasticsearch/elasticsearch.keystore`
- 同步密钥库到集群所有节点[^1]:
```bash
scp /etc/elasticsearch/elasticsearch.keystore node2:/etc/elasticsearch/
```
#### 5. **验证网络连接**
```bash
# 从 Kibana 服务器测试连接
telnet 192.168.200.220 9200
# 检查防火墙规则
sudo iptables -L -n | grep 9200
```
#### 6. **日志分析**
- Kibana 日志:`/var/log/kibana/kibana.log`
- Elasticsearch 日志:`/var/log/elasticsearch/*.log`
关键排查字段:
```
[ERROR][plugins.security] Authentication to http://192.168.200.220:9200 failed
[WARN][plugins.elasticsearch] Unable to retrieve version information...
```
#### 7. **最终验证**
```bash
# 检查 Kibana 系统用户权限
curl -u kibana_system:YourNewSecurePassword http://localhost:9200/_security/_authenticate
```
预期返回:
```json
{
"username": "kibana_system",
"roles": ["kibana_system"],
"authenticated": true
}
```
> **重要提示**:生产环境必须启用 SSL 证书验证,`elasticsearch.ssl.verificationMode: none` 仅用于临时测试[^3]。
---
### 相关问题
1. Elasticsearch 安全功能启用后如何配置集群节点间的双向 TLS 认证?
2. Kibana 无法连接 Elasticsearch 时有哪些系统级的故障排除步骤?
3. 如何监控 Elasticsearch 集群的安全事件和异常登录尝试?
4. 使用 JMeter 对 Elasticsearch 进行压力测试时应关注哪些安全配置参数?
5. 在启用 xpack 安全模块时,如何通过 Grafana 监控 Elasticsearch 的用户认证成功率?
[^1]: Failed to authenticate user 'elastic' against http://192.168.200.220:9200/_xpack/security/_authenticate?pretty
[^2]: 启用 Elasticsearch 安全功能后,用户必须使用有效的用户名和密码登录 Kibana
[^3]: 【实战ES】实战 Elasticsearch:快速上手与深度实践-7.1.2Flink CDC同步MySQL数据
阅读全文
相关推荐



















