The version of the Search Guard license that was included as part of SAS Visual Investigator 10.6 and SAS Visual Investigator 10.7 is due to expire on December 31, 2024.

Note: This issue does not apply to SAS^® Visual Investigator 10.8 and later releases. 

When the Search Guard license expires, the Elasticsearch log file shows errors that are similar to the following: 

Despite these Search Guard license errors, the functioning of Elasticsearch or SAS Visual Investigator is not affected.

To suppress the above messages, you must apply new Search Guard license files. The new license is valid for another calendar year.

For SAS Visual Investigator 10.7, the new Search Guard license files are provided with Hot Fix 6 and later for SAS Visual Investigator 10.7. The new license keys are applied after you install the hot fix.

For SAS Visual Investigator 10.6, you must apply the new Search Guard license manually. Also, if you cannot apply the latest SAS Visual Investigator 10.7 hot fix, you must apply the new license manually. 

Here are the steps to manually apply the new Search Guard license:

1. Obtain the new license file from SAS Technical Support.
2. Create an admin certificate for using the Elasticsearch REST API using the following commands. Ensure that you enter the correct information for your environment:
   
      export vault_token=/opt/sas/viya/config/etc/SASSecurityCertificateFramework/tokens/elasticsearch-secure/default/vault.token
   
      export cacert=/opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts/trustedcerts.pem
   
      export key=/opt/sas/viya/config/etc/elasticsearch/default/keys/searchguard/sgadminkey.pem
   
      export cert=/opt/sas/viya/config/etc/elasticsearch/default/certs/searchguard/sgadmincert.pem
   
      sudo /opt/sas/viya/home/SASSecurityCertificateFramework/bin/sas-crypto-management req-vault-cert --common-name "sgadmin" --vault-addr "https://vault-IP-address:8200"   --vault-cafile "${cacert}" --vault-token "${vault_token}" --out-crt "${cert}" --out-form 'pem' --out-key "${key}"
    
3. Update the license in Elasticsearch by using the following command (replace LICENSE with the actual license key value; also update the IP address):
   
      sudo curl -XPUT --cacert ${cacert} --key ${key} --cert ${cert} -HContent-Type:application/json -HAccept:application/json https://Elasticsearch-master-IP-address:9200/_searchguard/api/license?pretty -d '{"sg_license":"LICENSE"}'
   
   The expected response to this command is {     "status" : "OK",     "message" : "License updated." }
   
   As noted, the LICENSE value should have been replaced by the contents of the key value from the Search Guard license file that you received from SAS Technical Support. An example of what it would look like is -d '{"sg_license":"ADFGSS0gU0lHTkV…123FGSV98JKSNEQWE764Cg=="}"}' However, this "sg_license" number is an example only. Ensure that you copy and paste the key from the license file that you have received.
    
4. Confirm that the license has been updated in Elasticsearch by using the following command:
   
      sudo curl --cacert ${cacert} --key ${key} --cert ${cert} -HAccept:application/json https://Elasticsearch-master-IP-address:9200/_searchguard/api/license?pretty
   
   Confirm that the sg_license expiration date in the response is "2025-12-31."

Note: The steps need to be performed only on a single Elasticsearch node as the new license is applied to the entire cluster. Restarting the Elasticsearch service is not required after these steps.

Operating System and Release Information

Viya on Linux: An update for this issue is available for SAS Viya 3.5. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.5 for Linux Deployment Guide at

An update for this issue is available for SAS Visual Investigator 10.7. For instructions on how to access and apply these software updates, see the documentation links at the top of

An update for this issue is available for SAS Visual Investigator 10.7. For instructions on how to access and apply these software updates, see the documentation links at the top of

An update for this issue is available for SAS Visual Investigator 10.7. For instructions on how to access and apply these software updates, see the documentation links at the top of