License expirationedit

Your license is time based and expires at a future date. If you’re using monitoring features and your license will expire within 30 days, a license expiration warning is displayed prominently. Warnings are also displayed on startup and written to the Elasticsearch log starting 30 days from the expiration date. These error messages tell you when the license expires and what features will be disabled if you fail to update the license.


  • PUT / GET watch APIs will be disabled, DELETE watch API will continue to work
  • Watches will execute and write to the history
  • The actions of the watches will not execute


  • The agent will stop collecting cluster and indices metrics
  • The agent will stop automatically cleaning indices older than xpack.monitoring.history.duration


  • Graph explore APIs will be disabled


  • Reporting will no longer be available in Kibana
  • Report generation urls will stop working
  • Existing reports will no longer be accessible


  • Cluster health, cluster stats and indices stats operations will be blocked
  • All data operations (read and write) will continue to work

Once the license expires, calls to the cluster health, cluster stats, and index stats APIs fail with a security_exception and return a 403 HTTP status code.

  "error": {
    "root_cause": [
        "type": "security_exception",
        "reason": "current license is non-compliant for [security]",
        "license.expired.feature": "security"
    "type": "security_exception",
    "reason": "current license is non-compliant for [security]",
    "license.expired.feature": "security"
  "status": 403

This message enables automatic monitoring systems to easily detect the license failure without immediately impacting other users.

Machine learningedit

  • APIs to create jobs, open jobs, send data to jobs, create datafeeds, and start datafeeds will be disabled
  • All started datafeeds will be stopped. All open jobs will be closed
  • Existing job results will continue to be available by using Kibana or APIs

Logstash Pipeline Managementedit

  • Will not be able to create new pipelines and edit or delete existing pipelines from the UI
  • Will be able to list and view existing pipelines from the UI
  • Will be able to run Logstash instances which are registered to listen to existing pipelines

You should update your license as soon as possible. You are essentially flying blind when running with an expired license. Access to the cluster health and stats APIs is critical for monitoring and managing an Elasticsearch cluster.