How to troubleshoot / fix Elastalert2 elasticsearch auth

[jpsandiego]

My elastalert2 container was having issues authenticating correctly to ES:

WARNING:elasticsearch:GET https://lme-elasticsearch:9200/ [status:401 request:0.124s]
...
elasticsearch.exceptions.AuthenticationException: AuthenticationException(401, 'security_exception', 'unable to authenticate user [elastic] for REST request [/]')

I had changed the 'elastic' password previously via the Kibana UI which I think started this issue. Since then I've used the ./password_management.sh script to update vault, but it seems like that wasn't enough?

In case it's informative, here's some more feedback from various commands: noticed that when running , I'm shown:

extract_secrets.sh -p
...
elastic=Password for elastic has been set and encrypted
...

sudo -i podman exec lme-elastalert2 printenv ES_PASSWORD
Password for elastic has been set and encrypted.

(I was using a real password, but the password_management.sh script had actually stored the phrase "Password for elastic has been set and encrypted." into vault.)

I then noticed that password_management.sh had significant changes/improvements from the LME 2.0.0 version I had. I needed to do the upgrade to 2.2.0, so I just did that and it looks like that's the solution I needed.

Was about to not post this, but thought it might be useful if anyone else runs into an issue like this.

Thanks for all the excellent work on LME! Cheers!

[cbaxley]

I am glad the updated script worked for you. You had me scared for a minute there.