Metricbeat monitoring module elasticsearch-xpack error when Machine Learning is explicitly disabled

[crisdarocha]

Summary

When using the elasticsearch-xpack module to monitor an Elasticsearch node, this one fails if Machine Learning is explicitly disabled (xpack.ml.enabled: false).

Error fetching data for metricset elasticsearch.ml_job: HTTP error 400 in : 400 Bad Request

This is due to the response from GET _ml/anomaly_detectors/_all/_stats and is independent of license level.

If Machine Learning is not disabled, the response for this API call will be at least:

{
  "count": 0,
  "jobs": []
}

When setting xpack.ml.enabled: false, the response changes to:

{
  "error": "no handler found for uri [/_ml/anomaly_detectors/_all/_stats] and method [GET]"
}

Which won't be understood by the module as "I disabled ML".

For license levels where ML is not a feature, this setting has no impact, but for licenses that could have ML, one might want to explicitly disable it and this will cause monitoring errors.

• Steps to Reproduce:

1. Install a single node Elasticsearch cluster
2. Set xpack.ml.enabled: false in the elasticsearch.yml file
3. Issue GET _ml/anomaly_detectors/_all/_stats

{
  "error": "no handler found for uri [/_ml/anomaly_detectors/_all/_stats] and method [GET]"
}

Technical details

I investigated the issue and one way to fix it is to check if the ML is enabled to avoid getting the error shown. We can use the API to get the information - under features we can check if ml is enabled/available upfront.

[elasticmachine]

Pinging @elastic/stack-monitoring (Stack monitoring)

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[crisdarocha]

Still relevant!

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[crisdarocha]

Still relevant if not fixed yet.