title: Kibana 7.7.0 Basic version: management tab missing Security panel when started from docker
body: <p>Context: I want to use XPACK in order to control which user can see which Dasboard only with free version.</p>
  
  <p>I downloaded Kibana 7.7.0 zip from <a href="https://www.elastic.co/guide/en/kibana/7.x/windows.html" rel="nofollow noreferrer">here</a>, installed it and I can see Security options to create users/roles. In fact, I created an index, an user and a role and successfully set the index to this role with this installed Elastic/Kibana in my Windows.</p>
  
  <p>The issue happeans only with Elastic/Kibana started from docker. I started Kibana 7.7.0 from a docker and I can't see Security panel under Management page. Googling I found I must use Basic version Instead of Open Source. As far as I can see, the docker-compose bellow is downloading Basic version since there isn't "sso" at the end. Also I must use installers provided by Elastic instad of Apache. Well, as far as I see it is pulling image not related to Apache.</p>
  
  <p>I am not sure if the issue is only with Kibana since I could enable xpack security on Elastic and run elasticsearch-setup-passwords interactive inside the elastic docker container. I can log ing in Kibana with Elastic user but I don't see Security tab under Management. </p>
  
  <p>Also, I am getting issue from LogStash trying to connect to ElasticSearch even though I set the logstash_system (see logstash.conf bellow).</p>
  
  <p>You can see that I have enabled xpack.security.enabled=true on ElasticSearch.</p>
  
  <p>docker-compose.yml </p>
  
  <pre><code>version: '3.2'
  services:
  
    zoo1:
      image: elevy/zookeeper:latest
      environment:
        MYID: 1
        SERVERS: zoo1
      ports:
        - "2181:2181"
  
    kafka1:
      image: wurstmeister/kafka
      command: [start-kafka.sh]
      depends_on:
        - zoo1
      links:
        - zoo1
      ports:
        - "9092:9092"
      environment:
        KAFKA_LISTENERS: PLAINTEXT://:9092
        KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka1:9092
        KAFKA_BROKER_ID: 1
        KAFKA_ADVERTISED_PORT: 9092
        KAFKA_LOG_RETENTION_HOURS: "168"
        KAFKA_LOG_RETENTION_BYTES: "100000000"
        KAFKA_ZOOKEEPER_CONNECT:  zoo1:2181
        KAFKA_CREATE_TOPICS: "log:1:1"
        KAFKA_AUTO_CREATE_TOPICS_ENABLE: 'true'
  
    filebeat:
      image: docker.elastic.co/beats/filebeat:7.7.0
      command: filebeat -e -strict.perms=false
      volumes:
        - "//c/Users/my-comp/docker_folders/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
        - "//c/Users/my-comp/docker_folders/sample-logs:/sample-logs"
      links:
        - kafka1
      depends_on:
        - kafka1
  
    elasticsearch:
      image: docker.elastic.co/elasticsearch/elasticsearch:7.7.0
      environment:
        - cluster.name=docker-cluster
        - bootstrap.memory_lock=true
        - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
        - xpack.security.enabled=true
        - discovery.type=single-node
      ulimits:
        memlock:
          soft: -1
          hard: -1
      volumes:
       - "//c/Users/my-comp/docker_folders/esdata:/usr/share/elasticsearch/data"
      ports:
        - "9200:9200"
  
    kibana:
      image: docker.elastic.co/kibana/kibana:7.7.0
      volumes:
        - "//c/Users/my-comp/docker_folders/kibana.yml:/usr/share/kibana/config/kibana.yml"
      restart: always
      environment:
      - SERVER_NAME=kibana.localhost
      - ELASTICSEARCH_HOSTS=http://x.x.x.x:9200
      ports:
        - "5601:5601"
      links:
        - elasticsearch
      depends_on:
        - elasticsearch
  
    logstash:
      image: docker.elastic.co/logstash/logstash:7.7.0
      volumes:
        - "//c/Users/my-comp/docker_folders/logstash.conf:/config-dir/logstash.conf"
      restart: always
      command: logstash -f /config-dir/logstash.conf
      ports:
        - "9600:9600"
        - "7777:7777"
      links:
        - elasticsearch
        - kafka1
  </code></pre>
  
  <p>kibana.yml</p>
  
  <pre><code>server.name: kibana
  server.host: "0"
  xpack.monitoring.ui.container.elasticsearch.enabled: false
  elasticsearch.ssl.verificationMode: none
  elasticsearch.username: "kibana"
  elasticsearch.password: "k12345"
  </code></pre>
  
  <p>logstash.conf</p>
  
  <pre><code>input{
    kafka{
      codec =&gt; "json"
      bootstrap_servers =&gt; "kafka1:9092"
      topics =&gt; ["app_logs","request_logs"]
      tags =&gt; ["myapp"]
    }
  }
  
  filter {    
  *** not relevant
  }
  
  
  output {
    elasticsearch {
      hosts =&gt; ["http://x.x.x.x:9200"]
      index =&gt; "%{[fields][topic_name]}-%{+YYYY.MM.dd}"
      user =&gt; "logstash_system" 
      password =&gt; "l12345" 
    }
  }
  </code></pre>
  
  <p>In case it is worth to mention, LogStash is failling to connect to ElasticSearch with this log and, as you can see from logstash.conf I set up logstash_system (the user created from elasticsearch-setup-passwords interactive)</p>
  
  <pre><code>logstash_1       | [2020-05-19T20:18:45,559][WARN ][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error. {:url=&gt;"http://elasticsearch:9200/", :error_type=&gt;LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=&gt;"Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/'"}
  logstash_1       | [2020-05-19T20:19:13,815][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=&gt;"Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/_xpack'"}
  </code></pre>
  
  <p>So, my straight question is: am I missing some extra configuration in order to enable Security on Kibana? Surrounding questions are: is Kibana/Elastic from docker not the same from zip file? Am I missing some extra configurationin order to allow Logstash to connect to ElasticSearch</p>
  
  <p>*** edited</p>
  
  <p>LogStash is still failling to connect to ElasticSearch after I changed to</p>
  
  <p>logstash.conf</p>
  
  <pre><code>...
  output {
    elasticsearch {
      #hosts =&gt; [ "${ELASTIC_HOST1}", "${ELASTIC_HOST2}", "${ELASTIC_HOST3}" ]
      #hosts =&gt; ["http://192.168.99.100:9200"]
      index =&gt; "%{[fields][topic_name]}-%{+YYYY.MM.dd}"
      xpack.monitoring.elasticsearch.hosts: ["http://192.168.99.100:9200"]
      xpack.monitoring.elasticsearch.username: "logstash_system"
      xpack.monitoring.elasticsearch.password: =&gt; "l12345" 
    }
  }
  </code></pre>
  
  <p>The logs are</p>
  
  <pre><code>logstash_1       | WARNING: All illegal access operations will be denied in a future release
  logstash_1       | Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties
  logstash_1       | [2020-05-20T13:39:05,095][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
  logstash_1       | [2020-05-20T13:39:05,120][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=&gt;"7.7.0"}
  logstash_1       | [2020-05-20T13:39:06,134][WARN ][logstash.monitoringextension.pipelineregisterhook] xpack.monitoring.enabled has not been defined, but found elasticsearch configuration. Please explicitly set `xpack.monitoring.enabled: true` in logstash.yml
  logstash_1       | [2020-05-20T13:39:06,150][WARN ][deprecation.logstash.monitoringextension.pipelineregisterhook] Internal collectors option for Logstash monitoring is deprecated and targeted for removal in the next major version.
  logstash_1       | Please configure Metricbeat to monitor Logstash. Documentation can be found at:
  logstash_1       | https://www.elastic.co/guide/en/logstash/current/monitoring-with-metricbeat.html
  logstash_1       | [2020-05-20T13:39:08,008][INFO ][logstash.licensechecker.licensereader] Elasticsearch pool URLs updated {:changes=&gt;{:removed=&gt;[], :added=&gt;[http://elasticsearch:9200/]}}
  logstash_1       | [2020-05-20T13:39:08,408][WARN ][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error. {:url=&gt;"http://elasticsearch:9200/", :error_type=&gt;LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=&gt;"Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/'"}
  logstash_1       | [2020-05-20T13:39:08,506][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=&gt;"Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/_xpack'"}
  filebeat_1       | 2020-05-20T13:38:53.069Z     INFO    log/harvester.go:297    Harvester started for file: /sample-logs/request-2019-11-17F.log
  logstash_1       | [2020-05-20T13:39:08,611][ERROR][logstash.monitoring.internalpipelinesource] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.
  logstash_1       | [2020-05-20T13:39:11,449][ERROR][logstash.agent           ] Failed to execute action {:action=&gt;LogStash::PipelineAction::Create/pipeline_id:main, :exception=&gt;"LogStash::ConfigurationError", :message=&gt;"Expected one of [A-Za-z0-9_-], [ \\t\\r\\n], \"#\", \"=&gt;\" at line 86, column 7 (byte 2771) after output {\r\n  elasticsearch {\r\n    #hosts =&gt; [ \"${ELASTIC_HOST1}\", \"${ELASTIC_HOST2}\", \"${ELASTIC_HOST3}\" ]\r\n\t#hosts =&gt; [\"http://192.168.99.100:9200\"]\r\n    index =&gt; \"%{[fields][topic_name]}-%{+YYYY.MM.dd}\"\r\n\txpack", :backtrace=&gt;["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:58:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:66:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:28:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:27:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:181:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:67:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:43:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:342:in `block in converge_state'"]}
  </code></pre>
  
  <p>I guess the most relevant part of this log is:</p>
  
  <pre><code>logstash_1       | [2020-05-20T13:39:08,008][INFO ][logstash.licensechecker.licensereader] Elasticsearch pool URLs updated {:changes=&gt;{:removed=&gt;[], :added=&gt;[http://elasticsearch:9200/]}}
  logstash_1       | [2020-05-20T13:39:08,408][WARN ][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error. {:url=&gt;"http://elasticsearch:9200/", :error_type=&gt;LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=&gt;"Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/'"}
  logstash_1       | [2020-05-20T13:39:08,506][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=&gt;"Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/_xpack'"}
  </code></pre>
  
  <p>Take a note it is failling with ""Got response code '401' contacting Elasticsearch at URL '<a href="http://elasticsearch:9200/_xpack" rel="nofollow noreferrer">http://elasticsearch:9200/_xpack</a>'" error. I guess that in my particular docker setups it demands to be the Docker Machine IP which in my case is 192.168.99.100. Is there someway to replace elasticsearch by this IP?</p>