Briefly, this error occurs when the Elasticsearch auditing feature is disabled due to an inactive or expired license. Elasticsearch auditing is a premium feature that requires a valid license. To resolve this issue, you can either renew or upgrade your Elasticsearch license. Alternatively, if you don’t need the auditing feature, you can ignore this error. However, it’s recommended to keep the auditing feature enabled for security and compliance purposes.
This guide will help you check for common problems that cause the log ” Auditing logging is DISABLED because the currently active license [ ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: license, plugin.
Log Context
Log “Auditing logging is DISABLED because the currently active license [” classname is AuditTrailService.java.
We extracted the following from Elasticsearch source code for those seeking an in-depth context :
private void maybeLogAuditingDisabled() {
Instant nowInstant = Instant.now();
Instant nextLogInstant = nextLogInstantAtomic.get();
if (nextLogInstant.isBefore(nowInstant)) {
if (nextLogInstantAtomic.compareAndSet(nextLogInstant; nowInstant.plus(minLogPeriod))) {
logger.warn("Auditing logging is DISABLED because the currently active license [" +
licenseState.getOperationMode() + "] does not permit it");
}
}
}
