Elasticsearch started life as a free product and security was a paid addon to that product via the X-Pack, now Elastic Co has made the security stuff free but people still don't implement it. Elasticsearch is insecure out of the box and it takes extra steps to get it secured, and most people don't do those steps even though its pretty well documented right here:
Security features in Elastic still require paid subscription. The link you pasted even says that. You can use the xpack features for free on a trial basis but for production use you're required to buy a license.
This is not true, you can use some xpack security features such as basic auth, client TLS and node-to-node TLS for free. We use basic auth (with Vault integration) at my company using just the basic license. https://www.elastic.co/subscriptions has details on the subscription levels.
Thanks, I did not know about basic license. Although if you wanted to use OSS license my point still stands. (Not sure what restrictions the basic license brings so for some the only option might be the OSS license.)
You're right, and it is only recently that this stuff became free anyways, sometime last year. I think Amazon's OpenDistro stuff put some pressure on them. Even TLS was gated, which was the biggest offense in my opinion!
https://www.elastic.co/guide/en/elasticsearch/reference/curr...