WARNING: Version 6.0 of Elasticsearch has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
In addition to the Elasticsearch bootstrap checks, there are checks that are specific to X-Pack features.
If you use Watcher and have chosen to encrypt sensitive data (by setting
xpack.watcher.encrypt_sensitive_data to true), you must also place a key in
the secure settings store.
To pass this bootstrap check, you must set the xpack.watcher.encryption_key
on each node in the cluster. For more information, see
Encrypting Sensitive Data in Watcher.
If you use X-Pack security and a Public Key Infrastructure (PKI) realm, you must configure Transport Layer Security (TLS) on your cluster and enable client authentication on the network layers (either transport or http). For more information, see PKI User Authentication and Setting Up TLS on a Cluster.
To pass this bootstrap check, if a PKI realm is enabled, you must configure TLS and enable client authentication on at least one network communication layer.
If you authenticate users with realms other than native or file realms, you
must create role mappings. These role mappings define which roles are assigned
to each user.
If you use files to manage the role mappings, you must configure a YAML file
and copy it to each node in the cluster. By default, role mappings are stored in
ES_PATH_CONF/x-pack/role_mapping.yml. Alternatively, you can specify a
different role mapping file for each type of realm and specify its location in
the elasticsearch.yml file. For more information, see
Using Role Mapping Files.
To pass this bootstrap check, the role mapping files must exist and must be valid. The Distinguished Names (DNs) that are listed in the role mappings files must also be valid.
In 6.0 and later releases, if you have a gold, platinum, or enterprise license and X-Pack security is enabled, you must configure SSL/TLS for internode-communication.
Single-node clusters that use a loopback interface do not have this requirement. For more information, see Encrypting Communications.
To pass this bootstrap check, you must set up SSL/TLS in your cluster.
If you use X-Pack security and the built-in token service is enabled, you must configure your cluster to use SSL/TLS for the HTTP interface. HTTPS is required in order to use the token service.
In particular, if xpack.security.authc.token.enabled and http.enabled are
set to true in the elasticsearch.yml file, you must also set
xpack.security.http.ssl.enabled to true. For more information about these
settings, see Security settings and HTTP.
To pass this bootstrap check, you must enable HTTPS or disable the built-in token service by using the X-Pack security settings.