Briefly, this error occurs when a connection attempt is made from an IP address that is not allowed by the transport profile rules in Elasticsearch. This is a security feature to prevent unauthorized access. To resolve this issue, you can either add the IP address to the allowed list in the transport profile rules or check if the IP address attempting to connect is correct. If it’s a dynamic IP, consider using a range or a wildcard. Also, ensure that the network settings are correctly configured in Elasticsearch.
This guide will help you check for common problems that cause the log ” {}[ip_filter] [connection_denied]\torigin_address=[{}]; transport_profile=[{}]; rule=[{}]{} ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin.
Log Context
Log “{}[ip_filter] [connection_denied]\torigin_address=[{}]; transport_profile=[{}]; rule=[{}]{}” classname is DeprecatedLoggingAuditTrail.java.
We extracted the following from Elasticsearch source code for those seeking an in-depth context :
}
@Override
public void connectionDenied(InetAddress inetAddress; String profile; SecurityIpFilterRule rule) {
if (events.contains(CONNECTION_DENIED) && (eventFilterPolicyRegistry.ignorePredicate().test(AuditEventMetaInfo.EMPTY) == false)) {
logger.info("{}[ip_filter] [connection_denied]\torigin_address=[{}]; transport_profile=[{}]; rule=[{}]{}"; localNodeInfo.prefix;
NetworkAddress.format(inetAddress); profile; rule; opaqueId());
}
}
@Override
