# Open Distro alert plugin elasticsearch exception **URL:** \ **Category:** Alerting\ **Created:** [October 7, 2020, 8:32am UTC](https://forum.opensearch.org/t/open-distro-alert-plugin-elasticsearch-exception/3895 "2020-10-07T08:32:55Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![pado](https://avatars.discourse-cdn.com/v4/letter/p/7ea924/32.png) [@pado](https://forum.opensearch.org/u/pado)\ **Post date:** [October 7, 2020, 8:32am UTC](https://forum.opensearch.org/t/open-distro-alert-plugin-elasticsearch-exception/3895/1 "2020-10-07T08:32:55Z")
I trying open distro alert plugin for dockerized kibana and elastisearch and logstash. I have installed the plugins in kibana and elasticsearch, but periodically elasticsearch print this stacktrace: ```auto elasticsearch_1 | {"type": "server", "timestamp": "2020-10-07T08:07:38,744Z", "level": "ERROR", "component": "c.a.o.a.MonitorRunner", "cluster.name": "docker-cluster", "node.name": "474140009e51", "message": "Error loading alerts for monitor: PxkNAnUB9CNABdEIKobB", "cluster.uuid": "_FnIlDXOQHumHM4k50AP0Q", "node.id": "9j6JbC9QRVaSNAx78bMHDw" , elasticsearch_1 | "stacktrace": ["org.elasticsearch.ElasticsearchSecurityException: action [indices:data/read/search] is unauthorized for user [_system]", elasticsearch_1 | "at org.elasticsearch.xpack.core.security.support.Exceptions.authorizationError(Exceptions.java:34) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authz.AuthorizationService.denialException(AuthorizationService.java:601) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authz.AuthorizationService.authorizeSystemUser(AuthorizationService.java:392) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authz.AuthorizationService.authorize(AuthorizationService.java:193) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.authorizeRequest(SecurityActionFilter.java:173) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.lambda$applyInternal$3(SecurityActionFilter.java:159) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:63) ~[elasticsearch-7.9.1.jar:7.9.1]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$writeAuthToContext$24(AuthenticationService.java:680) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.writeAuthToContext(AuthenticationService.java:695) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$handleNullToken$18(AuthenticationService.java:574) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.handleNullToken(AuthenticationService.java:584) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.consumeToken(AuthenticationService.java:437) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$extractToken$9(AuthenticationService.java:405) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.extractToken(AuthenticationService.java:425) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$checkForApiKey$3(AuthenticationService.java:366) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:63) ~[elasticsearch-7.9.1.jar:7.9.1]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.ApiKeyService.authenticateWithApiKeyIfPresent(ApiKeyService.java:345) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.checkForApiKey(AuthenticationService.java:347) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$authenticateAsync$0(AuthenticationService.java:329) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:63) ~[elasticsearch-7.9.1.jar:7.9.1]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.TokenService.getAndValidateToken(TokenService.java:405) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$authenticateAsync$2(AuthenticationService.java:325) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$lookForExistingAuthentication$6(AuthenticationService.java:384) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lookForExistingAuthentication(AuthenticationService.java:395) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.authenticateAsync(AuthenticationService.java:320) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.access$000(AuthenticationService.java:261) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.authc.AuthenticationService.authenticate(AuthenticationService.java:156) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.applyInternal(SecurityActionFilter.java:156) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.apply(SecurityActionFilter.java:108) ~[?:?]", elasticsearch_1 | "at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:177) ~[elasticsearch-7.9.1.jar:7.9.1]", elasticsearch_1 | "at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:155) ~[elasticsearch-7.9.1.jar:7.9.1]", elasticsearch_1 | "at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:83) ~[elasticsearch-7.9.1.jar:7.9.1]", elasticsearch_1 | "at org.elasticsearch.client.node.NodeClient.executeLocally(NodeClient.java:83) ~[elasticsearch-7.9.1.jar:7.9.1]", elasticsearch_1 | "at org.elasticsearch.client.node.NodeClient.doExecute(NodeClient.java:72) ~[elasticsearch-7.9.1.jar:7.9.1]", elasticsearch_1 | "at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:409) ~[elasticsearch-7.9.1.jar:7.9.1]", elasticsearch_1 | "at org.elasticsearch.client.support.AbstractClient.search(AbstractClient.java:542) ~[elasticsearch-7.9.1.jar:7.9.1]", elasticsearch_1 | "at com.amazon.opendistroforelasticsearch.alerting.MonitorRunner$loadCurrentAlerts$response$1.invoke(MonitorRunner.kt:334) ~[opendistro_alerting-1.10.1.2.jar:1.10.1.2]", elasticsearch_1 | "at com.amazon.opendistroforelasticsearch.alerting.MonitorRunner$loadCurrentAlerts$response$1.invoke(MonitorRunner.kt:96) ~[opendistro_alerting-1.10.1.2.jar:1.10.1.2]", elasticsearch_1 | "at com.amazon.opendistroforelasticsearch.alerting.elasticapi.ElasticExtensionsKt.suspendUntil(ElasticExtensions.kt:146) ~[alerting-core-1.10.1.2.jar:?]", elasticsearch_1 | "at com.amazon.opendistroforelasticsearch.alerting.MonitorRunner.loadCurrentAlerts(MonitorRunner.kt:334) ~[opendistro_alerting-1.10.1.2.jar:1.10.1.2]", elasticsearch_1 | "at com.amazon.opendistroforelasticsearch.alerting.MonitorRunner.runMonitor(MonitorRunner.kt:196) [opendistro_alerting-1.10.1.2.jar:1.10.1.2]", elasticsearch_1 | "at com.amazon.opendistroforelasticsearch.alerting.MonitorRunner.runMonitor$default(MonitorRunner.kt:187) [opendistro_alerting-1.10.1.2.jar:1.10.1.2]", elasticsearch_1 | "at com.amazon.opendistroforelasticsearch.alerting.MonitorRunner$runJob$1.invokeSuspend(MonitorRunner.kt:184) [opendistro_alerting-1.10.1.2.jar:1.10.1.2]", elasticsearch_1 | "at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) [kotlin-stdlib-1.3.72.jar:1.3.72-release-468 (1.3.72)]", elasticsearch_1 | "at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:233) [kotlinx-coroutines-core-1.1.1.jar:?]", elasticsearch_1 | "at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:594) [kotlinx-coroutines-core-1.1.1.jar:?]", elasticsearch_1 | "at kotlinx.coroutines.scheduling.CoroutineScheduler.access$runSafely(CoroutineScheduler.kt:60) [kotlinx-coroutines-core-1.1.1.jar:?]", elasticsearch_1 | "at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:742) [kotlinx-coroutines-core-1.1.1.jar:?]"] } ``` Also I can create monitors, triggers and destinations but alert not work. How can i solve it? Thanks in advance. ---
**Author:** ![skkosuri-amzn](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/skkosuri-amzn/32/935_2.png) [@skkosuri-amzn](https://forum.opensearch.org/u/skkosuri-amzn)\ **Post date:** [October 12, 2020, 1:58am UTC](https://forum.opensearch.org/t/open-distro-alert-plugin-elasticsearch-exception/3895/2 "2020-10-12T01:58:55Z")
Looks like xpack is installed? Currently, opendistro plugins are not supported with xpack. ---
**Author:** ![skkosuri-amzn](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/skkosuri-amzn/32/935_2.png) [@skkosuri-amzn](https://forum.opensearch.org/u/skkosuri-amzn)\ **Post date:** [October 17, 2020, 6:47pm UTC](https://forum.opensearch.org/t/open-distro-alert-plugin-elasticsearch-exception/3895/3 "2020-10-17T18:47:26Z")