Getting error after installed standlone elasticsearch security plugin

I am new to opendistro standlone plugins. I tried to customize my ELK stack (from elastic.io) with opendistro security and alerting plugin in centos 7. I have successsfully installed the security elastic search plugin with the opendistro provided demo certificates (env is non prod).

Before adding opendistro security plugin, I was successfully running this ELK without any issues.

Versions :

Eleasticsearch - 7.4.2
Kibana - 7.4.2
Opendistro security plugin - 1.4.0.0
I have onl one VM, which contains Logstash, Elasticsearch and Kibana (with newly added openistro security and alerting plugin)

After installation, restarted elasticsearch (sudo systemctl start elasticsearch), I am getting an error like below:

org.elasticsearch.common.xcontent.json.JsonXContentParser.nextToken(JsonXContentParser.java:52)
elasticsearch[24567]: at org.elasticsearch.common.settings.Settings.fromXContent(Settings.java:645)
Feb 15 20:52:46 elasticsearch[24567]: at org.elasticsearch.common.settings.Settings.fromXContent(Settings.java:620)
Feb 15 20:52:46 elasticsearch[24567]: at org.elasticsearch.common.settings.Settings.access$400(Settings.java:82)
Feb 15 20:52:46 elasticsearch[24567]: at org.elasticsearch.common.settings.Settings$Builder.loadFromStream(Settings.java:1093)

[2020-02-15T20:37:46,352][INFO ][o.e.n.Node ] [master] stopping …
[2020-02-15T20:37:46,385][INFO ][o.e.x.w.WatcherService ] [master] stopping watch service, reason [shutdown initiated]
[2020-02-15T20:37:46,386][INFO ][o.e.x.w.WatcherLifeCycleService] [master] watcher has stopped and shutdown
[2020-02-15T20:37:46,711][INFO ][o.e.x.m.p.l.CppLogMessageHandler] [master] [controller/11581] [Main.cc@150] Ml controller exiting
[2020-02-15T20:37:46,712][INFO ][o.e.x.m.p.NativeController] [master] Native controller process has stopped - no new native processes can be started
[2020-02-15T20:37:52,246][INFO ][o.e.n.Node ] [master] stopped
[2020-02-15T20:37:52,246][INFO ][o.e.n.Node ] [master] closing …
[2020-02-15T20:37:52,338][INFO ][o.e.n.Node ] [master] closed

while installing, I was getting some warning like below (oracle java) :

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: plugin requires additional permissions @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

  • java.lang.RuntimePermission createClassLoader
  • java.lang.RuntimePermission getClassLoader
  • java.net.NetPermission getProxySelector
  • java.net.SocketPermission * connect,resolve
    See Permissions in the JDK
    for descriptions of what these permissions allow and the associated risks.

please help me to resolved this issue.

more stacktrace on this issue -

{“type”: “server”, “timestamp”: “2020-02-17T10:14:18,750Z”, “level”: “INFO”, “component”: “o.e.x.m.p.l.CppLogMessageHandler”, “cluster.name”: “idams-nonprod-elk”, “node.name”: “master”, “message”: “[controller/33614] [Main.cc@110] controller (64 bit): Version 7.4.2 (Build 473f61b8a5238b) Copyright (c) 2019 Elasticsearch BV” }
{“type”: “server”, “timestamp”: “2020-02-17T10:14:20,994Z”, “level”: “DEBUG”, “component”: “o.e.a.ActionModule”, “cluster.name”: “idams-nonprod-elk”, “node.name”: “master”, “message”: “Using REST wrapper from plugin org.elasticsearch.xpack.security.Security” }
{“type”: “server”, “timestamp”: “2020-02-17T10:14:20,995Z”, “level”: “DEBUG”, “component”: “o.e.a.ActionModule”, “cluster.name”: “idams-nonprod-elk”, “node.name”: “master”, “message”: “Using REST wrapper from plugin com.amazon.opendistroforelasticsearch.security.OpenDistroSecurityPlugin” }
{“type”: “server”, “timestamp”: “2020-02-17T10:14:21,004Z”, “level”: “ERROR”, “component”: “o.e.b.Bootstrap”, “cluster.name”: “idams-nonprod-elk”, “node.name”: “master”, “message”: “Exception”,
“stacktrace”: [“java.lang.IllegalArgumentException: Cannot have more than one plugin implementing a REST wrapper”,
“at org.elasticsearch.action.ActionModule.(ActionModule.java:396) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.node.Node.(Node.java:457) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.node.Node.(Node.java:255) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:221) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) [elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) [elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) [elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) [elasticsearch-cli-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115) [elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-7.4.2.jar:7.4.2]”] }
{“type”: “server”, “timestamp”: “2020-02-17T10:14:21,028Z”, “level”: “WARN”, “component”: “o.e.b.ElasticsearchUncaughtExceptionHandler”, “cluster.name”: “idams-nonprod-elk”, “node.name”: “master”, “message”: “uncaught exception in thread [main]”,
“stacktrace”: [“org.elasticsearch.bootstrap.StartupException: java.lang.IllegalArgumentException: Cannot have more than one plugin implementing a REST wrapper”,
“at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:163) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) ~[elasticsearch-cli-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“Caused by: java.lang.IllegalArgumentException: Cannot have more than one plugin implementing a REST wrapper”,
“at org.elasticsearch.action.ActionModule.(ActionModule.java:396) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.node.Node.(Node.java:457) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.node.Node.(Node.java:255) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:221) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.4.2.jar:7.4.2]”,
“… 6 more”] }

I also tried to disable the xpack in elasticsearch.yml file (xpack.security.enabled: false), still failing…

please help me to resolve this issue.

Hello !
Whenever I had xpack’s related errors,I fixed them with installing Elasticsearch-OSS version. Open Source Software, not the Elasticsearch basic version.
Maybe It can fix your error.

Cannot have more than one plugin implementing a REST wrapper
You should investigate this error.

Hope it helps.
Thi

I solved this by completely removing xpack security from modules directory.

As for prrmissions - which version of Java you are using? I think I’ve seen some simillar problems with Java 13, so still sit with 11.

Currently running 7.1.1 with X-Pack basic for ILM + OpenDistro Security 1.1.0.3.

Thank you for your reply.

Thank you @DmitryOlshansky

I am using openJDK 1.8 version in centos 7.

could you pls share the steps that yo followed to implement the opendistro security / alerting plugins with ELK 7.x (from elastic.io). you did remove the x-pack plugins from the elastic search plugins folder or anything more?

appreciate your help and support.

Regards.

Sorry for dropping off so rapidly, I’m not used to these online discuss thingies.

As for steps, that’s what I did in our playbooks on Ubuntu:
rm -rf /usr/share/elasticsearch/modules/x-pack-security

Also I dropped ML plugin as we’ll never use it so why keep trash around:
rm -rf /usr/share/elasticsearch/modules/x-pack-ml

It’s enough to avoid this conflict

Is there way to get it working without deleting x-pack module

@parag1 Did you try disabling the x-pack security module? the 2 can’t be run side by side. Hope this helps