ELK installation on docker

Question

I took ELK container from here using the command :

sudo docker run -p 5601:5601 -p 9200:9200 -p 5044:5044 -it --name elk sebp/elk

It runs fabulously, but I cannot use it without my configuration for logstash and elasticsearch can we ? so I killed the services and added the configuration. I changed the users to a new user called elk:elk . Now when I try to start the elasticsearch it fails with the following exception :

Exception in thread "main" org.elasticsearch.bootstrap.BootstrapException: java.nio.file.AccessDeniedException: /etc/elasticsearch/elasticsearch.keystore
Likely root cause: java.nio.file.AccessDeniedException: /etc/elasticsearch/elasticsearch.keystore
        at sun.nio.fs.UnixException.translateToIOException(UnixException.java:84)
        at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
        at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
        at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:214)
        at java.nio.file.Files.newByteChannel(Files.java:361)
        at java.nio.file.Files.newByteChannel(Files.java:407)
        at org.apache.lucene.store.SimpleFSDirectory.openInput(SimpleFSDirectory.java:77)
        at org.elasticsearch.common.settings.KeyStoreWrapper.load(KeyStoreWrapper.java:207)
        at org.elasticsearch.bootstrap.Bootstrap.loadSecureSettings(Bootstrap.java:226)
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:291)
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136)
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127)
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
        at org.elasticsearch.cli.Command.main(Command.java:90)
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93)
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86)
Refer to the log for complete error details.

Answer 1

There is an open issue on github for this error, https://github.com/elastic/ansible-elasticsearch/issues/430

elasticsearch tries to write and read from its config directory in version 6.x. Current fix is to explicitly set permission to g+ws , ie

chmod g+ws /etc/elasticsearch

Answer 2

Probably you need to set the proper ownership and permission of the keystore file.

# chown elasticsearch:elasticsearch /etc/elasticsearch/elasticsearch.keystore
# chmod 600 /etc/elasticsearch/elasticsearch.keystore