License Expiration

Your X-Pack license is time based and will expire at a future date. If you’re using X-Pack monitoring and your license will expire within 30 days, a license expiration warning is displayed prominently. Warnings are also displayed on startup and written to the Elasticsearch log starting 30 days from the expiration date. These error messages tell you when the license expires and what features will be disabled if you fail to update the license.

Watcher

  • PUT / GET watch APIs will be disabled, DELETE watch API will continue to work
  • Watches will execute and write to the history
  • The actions of the watches will not execute

Monitoring

  • The agent will stop collecting cluster and indices metrics
  • The agent will stop automatically cleaning indices older than xpack.monitoring.history.duration

Graph

  • Graph explore APIs will be disabled

Reporting

  • Reporting will no longer be available in Kibana
  • Report generation urls will stop working
  • Existing reports will no longer be accessible

Security

  • Cluster health, cluster stats and indices stats operations will be blocked
  • All data operations (read and write) will continue to work

Machine learning

  • APIs to create jobs, open jobs, send data to jobs, create datafeeds, and start datafeeds will be disabled
  • All started datafeeds will be stopped. All open jobs will be closed
  • Existing job results will continue to be available by using Kibana or APIs

Once the license expires, calls to the cluster health, cluster stats, and index stats APIs fail with a security_exception and return a 403 HTTP status code.

{
  "error": {
    "root_cause": [
      {
        "type": "security_exception",
        "reason": "current license is non-compliant for [security]",
        "license.expired.feature": "security"
      }
    ],
    "type": "security_exception",
    "reason": "current license is non-compliant for [security]",
    "license.expired.feature": "security"
  },
  "status": 403
}

This message enables automatic monitoring systems to easily detect the license failure without immediately impacting other users.

Important

You should update your license as soon as possible. You are essentially flying blind when running with an expired license. Access to the cluster health and stats APIs is critical for monitoring and managing an Elasticsearch cluster.