title: Elasticsearch on Docker - Failed to create enrollment token when generating API key
body: <p>Going through the <a href="https://www.elastic.co/guide/en/elastic-stack-get-started/current/get-started-stack-docker.html#get-started-docker-tls" rel="nofollow noreferrer">Elasticsearch docs</a> for setting up Elasticsearch/Kibana with Docker, but I'm getting several errors. I follow the steps exactly. I'm running this on an Ubuntu 20.04 EC2 instance. <strong>What am I doing wrong?</strong></p>
  <p>Here's what I did:</p>
  <ol>
  <li><code>docker pull docker.elastic.co/elasticsearch/elasticsearch:8.0.0</code></li>
  <li><code>docker pull docker.elastic.co/kibana/kibana:8.0.0</code></li>
  <li><code>docker network create elastic</code></li>
  <li><code>docker run --name es01 --net elastic -p 9200:9200 -it docker.elastic.co/elasticsearch/elasticsearch:8.0.0</code></li>
  </ol>
  <p>After step 4, Elasticsearch says:</p>
  <blockquote>
  <p>A password is generated for the elastic user and output to the terminal, plus enrollment tokens for enrolling Kibana and adding additional nodes to your cluster.</p>
  </blockquote>
  <p>I get neither. Instead, I get these error logs:</p>
  <pre><code>{&quot;@timestamp&quot;:&quot;2022-02-24T22:28:24.318Z&quot;, &quot;log.level&quot;:&quot;ERROR&quot;, &quot;message&quot;:&quot;Failed to create enrollment token when generating API key&quot;, &quot;ecs.version&quot;: &quot;1.2.0&quot;,&quot;service.name&quot;:&quot;ES_ECS&quot;,&quot;event.dataset&quot;:&quot;elasticsearch.server&quot;,&quot;process.thread.name&quot;:&quot;elasticsearch[a178a1e9d98b][generic][T#4]&quot;,&quot;log.logger&quot;:&quot;org.elasticsearch.xpack.security.enrollment.InternalEnrollmentTokenGenerator&quot;,&quot;elasticsearch.cluster.uuid&quot;:&quot;mC4ceJ2nT7i9-QF6V537Zg&quot;,&quot;elasticsearch.node.id&quot;:&quot;IthIKocaSACunHatZxePPw&quot;,&quot;elasticsearch.node.name&quot;:&quot;a178a1e9d98b&quot;,&quot;elasticsearch.cluster.name&quot;:&quot;docker-cluster&quot;,&quot;error.type&quot;:&quot;org.elasticsearch.action.UnavailableShardsException&quot;,&quot;error.message&quot;:&quot;[.security-7][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.security-7][0]] containing [index {[.security][fobYLX8BZdXU5J2_mb_p], source[{\&quot;doc_type\&quot;:\&quot;api_key\&quot;,\&quot;creation_time\&quot;:1645741644265,\&quot;expiration_time\&quot;:1645743444265,\&quot;api_key_invalidated\&quot;:false,\&quot;api_key_hash\&quot;:\&quot;{PBKDF2}10000$PbPNTKm9i5HBuHO+W9snM/+0C1sf4OGjE3xC1m3xKew=$oQXD/UOSgR/hDNHz1IgNKoVOG4Zi0LkiPQW3IMPnRtA=\&quot;,\&quot;role_descriptors\&quot;:{\&quot;create_enrollment_token\&quot;:{\&quot;cluster\&quot;:[\&quot;cluster:admin/xpack/security/enroll/node\&quot;],\&quot;indices\&quot;:[],\&quot;applications\&quot;:[],\&quot;run_as\&quot;:[],\&quot;metadata\&quot;:{},\&quot;type\&quot;:\&quot;role\&quot;}},\&quot;limited_by_role_descriptors\&quot;:{\&quot;superuser\&quot;:{\&quot;cluster\&quot;:[\&quot;all\&quot;],\&quot;indices\&quot;:[{\&quot;names\&quot;:[\&quot;*\&quot;],\&quot;privileges\&quot;:[\&quot;all\&quot;],\&quot;allow_restricted_indices\&quot;:false},{\&quot;names\&quot;:[\&quot;*\&quot;],\&quot;privileges\&quot;:[\&quot;monitor\&quot;,\&quot;read\&quot;,\&quot;view_index_metadata\&quot;,\&quot;read_cross_cluster\&quot;],\&quot;allow_restricted_indices\&quot;:true}],\&quot;applications\&quot;:[{\&quot;application\&quot;:\&quot;*\&quot;,\&quot;privileges\&quot;:[\&quot;*\&quot;],\&quot;resources\&quot;:[\&quot;*\&quot;]}],\&quot;run_as\&quot;:[\&quot;*\&quot;],\&quot;metadata\&quot;:{\&quot;_reserved\&quot;:true},\&quot;type\&quot;:\&quot;role\&quot;}},\&quot;name\&quot;:\&quot;enrollment_token_API_key_fYbYLX8BZdXU5J2_mb_p\&quot;,\&quot;version\&quot;:8000099,\&quot;metadata_flattened\&quot;:null,\&quot;creator\&quot;:{\&quot;principal\&quot;:\&quot;_xpack_security\&quot;,\&quot;full_name\&quot;:null,\&quot;email\&quot;:null,\&quot;metadata\&quot;:{},\&quot;realm\&quot;:\&quot;__attach\&quot;,\&quot;realm_type\&quot;:\&quot;__attach\&quot;}}]}] blocking until refresh]&quot;,&quot;error.stack_trace&quot;:&quot;org.elasticsearch.action.UnavailableShardsException: [.security-7][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.security-7][0]] containing [index {[.security][fobYLX8BZdXU5J2_mb_p], source[{\&quot;doc_type\&quot;:\&quot;api_key\&quot;,\&quot;creation_time\&quot;:1645741644265,\&quot;expiration_time\&quot;:1645743444265,\&quot;api_key_invalidated\&quot;:false,\&quot;api_key_hash\&quot;:\&quot;{PBKDF2}10000$PbPNTKm9i5HBuHO+W9snM/+0C1sf4OGjE3xC1m3xKew=$oQXD/UOSgR/hDNHz1IgNKoVOG4Zi0LkiPQW3IMPnRtA=\&quot;,\&quot;role_descriptors\&quot;:{\&quot;create_enrollment_token\&quot;:{\&quot;cluster\&quot;:[\&quot;cluster:admin/xpack/security/enroll/node\&quot;],\&quot;indices\&quot;:[],\&quot;applications\&quot;:[],\&quot;run_as\&quot;:[],\&quot;metadata\&quot;:{},\&quot;type\&quot;:\&quot;role\&quot;}},\&quot;limited_by_role_descriptors\&quot;:{\&quot;superuser\&quot;:{\&quot;cluster\&quot;:[\&quot;all\&quot;],\&quot;indices\&quot;:[{\&quot;names\&quot;:[\&quot;*\&quot;],\&quot;privileges\&quot;:[\&quot;all\&quot;],\&quot;allow_restricted_indices\&quot;:false},{\&quot;names\&quot;:[\&quot;*\&quot;],\&quot;privileges\&quot;:[\&quot;monitor\&quot;,\&quot;read\&quot;,\&quot;view_index_metadata\&quot;,\&quot;read_cross_cluster\&quot;],\&quot;allow_restricted_indices\&quot;:true}],\&quot;applications\&quot;:[{\&quot;application\&quot;:\&quot;*\&quot;,\&quot;privileges\&quot;:[\&quot;*\&quot;],\&quot;resources\&quot;:[\&quot;*\&quot;]}],\&quot;run_as\&quot;:[\&quot;*\&quot;],\&quot;metadata\&quot;:{\&quot;_reserved\&quot;:true},\&quot;type\&quot;:\&quot;role\&quot;}},\&quot;name\&quot;:\&quot;enrollment_token_API_key_fYbYLX8BZdXU5J2_mb_p\&quot;,\&quot;version\&quot;:8000099,\&quot;metadata_flattened\&quot;:null,\&quot;creator\&quot;:{\&quot;principal\&quot;:\&quot;_xpack_security\&quot;,\&quot;full_name\&quot;:null,\&quot;email\&quot;:null,\&quot;metadata\&quot;:{},\&quot;realm\&quot;:\&quot;__attach\&quot;,\&quot;realm_type\&quot;:\&quot;__attach\&quot;}}]}] blocking until refresh]\n\tat org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.retryBecauseUnavailable(TransportReplicationAction.java:1076)\n\tat org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.doRun(TransportReplicationAction.java:872)\n\tat org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26)\n\tat org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase$2.onTimeout(TransportReplicationAction.java:1031)\n\tat org.elasticsearch.cluster.ClusterStateObserver$ContextPreservingListener.onTimeout(ClusterStateObserver.java:345)\n\tat org.elasticsearch.cluster.ClusterStateObserver$ObserverClusterStateListener.onTimeout(ClusterStateObserver.java:263)\n\tat org.elasticsearch.cluster.service.ClusterApplierService$NotifyTimeout.run(ClusterApplierService.java:651)\n\tat org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:717)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)\n\tat java.base/java.lang.Thread.run(Thread.java:833)\n&quot;}
  {&quot;@timestamp&quot;:&quot;2022-02-24T22:28:47.612Z&quot;, &quot;log.level&quot;:&quot;ERROR&quot;, &quot;message&quot;:&quot;error downloading geoip database [GeoLite2-ASN.mmdb]&quot;, &quot;ecs.version&quot;: &quot;1.2.0&quot;,&quot;service.name&quot;:&quot;ES_ECS&quot;,&quot;event.dataset&quot;:&quot;elasticsearch.server&quot;,&quot;process.thread.name&quot;:&quot;elasticsearch[a178a1e9d98b][generic][T#6]&quot;,&quot;log.logger&quot;:&quot;org.elasticsearch.ingest.geoip.GeoIpDownloader&quot;,&quot;elasticsearch.cluster.uuid&quot;:&quot;mC4ceJ2nT7i9-QF6V537Zg&quot;,&quot;elasticsearch.node.id&quot;:&quot;IthIKocaSACunHatZxePPw&quot;,&quot;elasticsearch.node.name&quot;:&quot;a178a1e9d98b&quot;,&quot;elasticsearch.cluster.name&quot;:&quot;docker-cluster&quot;,&quot;error.type&quot;:&quot;org.elasticsearch.action.UnavailableShardsException&quot;,&quot;error.message&quot;:&quot;[.geoip_databases][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.geoip_databases][0]] containing [index {[.geoip_databases][GeoLite2-ASN.mmdb_0_1645741637264], source[n/a, actual length: [1mb], max length: 2kb]}]]&quot;,&quot;error.stack_trace&quot;:&quot;org.elasticsearch.action.UnavailableShardsException: [.geoip_databases][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.geoip_databases][0]] containing [index {[.geoip_databases][GeoLite2-ASN.mmdb_0_1645741637264], source[n/a, actual length: [1mb], max length: 2kb]}]]\n\tat org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.retryBecauseUnavailable(TransportReplicationAction.java:1076)\n\tat org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.doRun(TransportReplicationAction.java:872)\n\tat org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26)\n\tat org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase$2.onTimeout(TransportReplicationAction.java:1031)\n\tat org.elasticsearch.cluster.ClusterStateObserver$ContextPreservingListener.onTimeout(ClusterStateObserver.java:345)\n\tat org.elasticsearch.cluster.ClusterStateObserver$ObserverClusterStateListener.onTimeout(ClusterStateObserver.java:263)\n\tat org.elasticsearch.cluster.service.ClusterApplierService$NotifyTimeout.run(ClusterApplierService.java:651)\n\tat org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:717)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)\n\tat java.base/java.lang.Thread.run(Thread.java:833)\n&quot;}
  {&quot;@timestamp&quot;:&quot;2022-02-24T22:28:54.310Z&quot;, &quot;log.level&quot;:&quot;ERROR&quot;, &quot;message&quot;:&quot;Failed to generate credentials for the elastic built-in superuser&quot;, &quot;ecs.version&quot;: &quot;1.2.0&quot;,&quot;service.name&quot;:&quot;ES_ECS&quot;,&quot;event.dataset&quot;:&quot;elasticsearch.server&quot;,&quot;process.thread.name&quot;:&quot;elasticsearch[a178a1e9d98b][generic][T#7]&quot;,&quot;log.logger&quot;:&quot;org.elasticsearch.xpack.security.InitialNodeSecurityAutoConfiguration&quot;,&quot;elasticsearch.cluster.uuid&quot;:&quot;mC4ceJ2nT7i9-QF6V537Zg&quot;,&quot;elasticsearch.node.id&quot;:&quot;IthIKocaSACunHatZxePPw&quot;,&quot;elasticsearch.node.name&quot;:&quot;a178a1e9d98b&quot;,&quot;elasticsearch.cluster.name&quot;:&quot;docker-cluster&quot;,&quot;error.type&quot;:&quot;org.elasticsearch.action.UnavailableShardsException&quot;,&quot;error.message&quot;:&quot;[.security-7][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.security-7][0]] containing [index {[.security][reserved-user-elastic], source[{\&quot;password\&quot;:\&quot;ff1DWkSBw4Cju0b8U7PM\&quot;,\&quot;enabled\&quot;:true,\&quot;type\&quot;:\&quot;reserved-user\&quot;}]}] and a refresh]&quot;,&quot;error.stack_trace&quot;:&quot;org.elasticsearch.action.UnavailableShardsException: [.security-7][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.security-7][0]] containing [index {[.security][reserved-user-elastic], source[{\&quot;password\&quot;:\&quot;ff1DWkSBw4Cju0b8U7PM\&quot;,\&quot;enabled\&quot;:true,\&quot;type\&quot;:\&quot;reserved-user\&quot;}]}] and a refresh]\n\tat org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.retryBecauseUnavailable(TransportReplicationAction.java:1076)\n\tat org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.doRun(TransportReplicationAction.java:872)\n\tat org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26)\n\tat org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase$2.onTimeout(TransportReplicationAction.java:1031)\n\tat org.elasticsearch.cluster.ClusterStateObserver$ContextPreservingListener.onTimeout(ClusterStateObserver.java:345)\n\tat org.elasticsearch.cluster.ClusterStateObserver$ObserverClusterStateListener.onTimeout(ClusterStateObserver.java:263)\n\tat org.elasticsearch.cluster.service.ClusterApplierService$NotifyTimeout.run(ClusterApplierService.java:651)\n\tat org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:717)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)\n\tat java.base/java.lang.Thread.run(Thread.java:833)\n&quot;}
  </code></pre>
  <p>They are long messages. Here's the error portion of the above:</p>
  <pre><code>&quot;Failed to create enrollment token when generating API key&quot;
  &quot;error downloading geoip database [GeoLite2-ASN.mmdb]&quot;
  &quot;Failed to generate credentials for the elastic built-in superuser&quot;
  &quot;error downloading geoip database [GeoLite2-City.mmdb]&quot;
  
  </code></pre>