Kibaba - Machine learning - access denied

[e101sg]

Dear all,

I am using T-POT (Standard) as VM. Trying to enable the Machine learning features in Kibana ( enabled the 30 day trial license). Can not access the ML feature. (attached the screen shot 1). After some search inside T-Pot , find that elasticsearch.yml in /opt/tpot/docker/elk/elasticsearch/dist .Modified the file as seen in the screen shot 2. Restart the T-Pot but still can not get access. Also can not find the location of kibana.yml. If not mistaken it should be appear in the Analytics page of Kibana. Any inputs helpful.
1.Access denied

2. elasticsearch.yml Edit

[Ganesh-403]

@e101sg
The "Access denied" message is usually not caused by a missing kibana.yml or simply enabling the trial license.

Machine Learning in Kibana has a few prerequisites:

• A valid trial or subscription (which you've already enabled).
• xpack.ml.enabled enabled on all Elasticsearch nodes (this is true by default). :contentReference[oaicite:0]{index=0}
• At least one Elasticsearch node with the ml node role if you're using explicit node.roles. :contentReference[oaicite:1]{index=1}
• A user with the required Machine Learning privileges in Kibana and Elasticsearch. :contentReference[oaicite:2]{index=2}

A few things to note about T-Pot:

1. Editing only elasticsearch.yml is probably not sufficient.

   From what I can tell, T-Pot manages Elasticsearch and Kibana through Docker. Configuration is typically injected via the Docker Compose stack and container configuration, so manual changes inside the container or image may be overwritten when the container is recreated.

2. The "Access denied" message often indicates a permissions issue rather than an ML configuration issue.

   If Elasticsearch is healthy and the ML APIs are enabled, Kibana can still deny access if the logged-in user doesn't have the required ML privileges. :contentReference[oaicite:3]{index=3}

3. Check whether ML APIs are actually enabled.

   From the Elasticsearch API:

   curl http://localhost:9200/_ml/info

   If this returns information about the ML subsystem, then xpack.ml.enabled is active. If it returns an error indicating the ML APIs are unavailable, then the node configuration still needs attention.

4. Verify the node roles.

   If you're using explicit node.roles, make sure the node includes the ml role. Otherwise, ML jobs cannot run. :contentReference[oaicite:4]{index=4}

Could you share a few more details?

• What exact T-Pot version are you running?
• What user are you logging into Kibana with?
• What is the output of:

curl http://localhost:9200/_ml/info
curl http://localhost:9200/_nodes?filter_path=nodes.*.roles

That will help determine whether this is:

• a permissions issue,
• an Elasticsearch ML configuration issue,
• or simply that the node isn't configured with the required ML role.

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.