All Products
Search

This Product

    E-MapReduce:Connect to Impala

    Document Center

    E-MapReduce:Connect to Impala

    Last Updated:Jul 17, 2026

    Use a command-line interface (CLI) to connect to Impala on E-MapReduce (EMR).

    Prerequisites

    You have created a cluster and selected the Impala service. For more information, see Create a cluster.

    Impala-shell connection

    Before you connect to Impala, run the impala-shell --help command to view available options.

    Standard cluster

    1. Connect to the master node of the cluster over SSH. For more information, see Log on to a cluster.

    2. Run the following command to connect to Impala.

      impala-shell -i <impalad_node_name>

      <impalad_node_name> is the name of an Impalad node. To obtain the node name, go to the Status tab of the Impala service in the EMR console, expand the Impalad component, and then find the name in the Node Name column of the topology list. For example, the node names can be core-1-1 and core-1-2. You can use any of these names to connect to Impala. Replace <impalad_node_name> in the preceding command with the node name that you obtain.

    3. Optional: Run the quit; command to exit the Impala CLI.

    High-security cluster

    1. Connect to the master node of the cluster over SSH. For more information, see Log on to a cluster.

    2. Initialize a credential.

      1. Run the following command to check for a Kerberos credential.

        klist

        If the output contains klist: No credentials cache found, initialize a credential in the next step. If the output already contains credential information, skip credential initialization and connect to Impala.

      2. Run the following command to view the principal.

        klist -k $IMPALA_CONF_DIR/impala.keytab

        Record the principal from the output. You will need it for the next step. For example, the principal is impala/master-1-1.c-45dcb9bbe234****.cn-hangzhou.emr.aliyuncs.com@EMR.C-45DCB9BBE23****.COM.

        [root@master-l-1(192.16xxx) ~]# klist -k $IMPALA_CONF_DIR/impala.keytab
Keytab name: FILE:/etc/taihao-apps/impala-conf/runtime-conf/impala.keytab
KVNO Principal
---- ----------------------------------------------------------------
   2 impala/master-l-1.c-45dcb9bbe234xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-45DCB9BBE234xxx.COM
   2 impala/master-l-1.c-45dcb9bbe234xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-45DCB9BBE234xxx.COM
   2 impala/master-l-1.c-45dcb9bbe234xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-45DCB9BBE234xxx.COM
   2 impala/master-l-1.c-45dcb9bbe234xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-45DCB9BBE234xxx.COM
   2 impala/master-l-1.c-45dcb9bbe234xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-45DCB9BBE234xxx.COM
   2 impala/master-l-1.c-45dcb9bbe234xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-45DCB9BBE234xxx.COM
   2 impala/master-l-1.c-45dcb9bbe234xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-45DCB9BBE234xxx.COM
   2 impala/master-l-1.c-45dcb9bbe234xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-45DCB9BBE234xxx.COM

      3. Run the following command to initialize the credential.

        kinit -k -t $IMPALA_CONF_DIR/impala.keytab <principal>
        Note

        Replace <principal> with the principal you recorded in the previous step.

    3. Run the following command to connect to Impala.

      impala-shell -k -i <impalad_node_name>

    4. Optional: Run the quit; command to exit the Impala CLI.

    Beeline JDBC connection

    Standard cluster

    1. Connect to the master node of the cluster over SSH. For more information, see Log on to a cluster.

    2. Run the following command to connect to Impala.

      beeline -u 'jdbc:hive2://<impalad_node_name>:28000/default;transportMode=http;uauth=noSasl'

    3. Optional: Run the quit; command to exit the Impala CLI.

    High-security cluster

    1. Connect to a core node of the cluster over SSH. For more information, see Log on to a cluster.

    2. Initialize a credential as the root user.

      1. Run the following command to check for a Kerberos credential.

        klist

        If the output contains the message klist: No credentials cache found, proceed to the next step to initialize an access credential. If the output contains credential information, skip credential initialization and use the impala-shell command to connect to Impala.

      2. Run the following command to view the principal.

        klist -k $IMPALA_CONF_DIR/impala.keytab

        Record the principal from the output. You will need it for the next step. For example, the principal is impala/core-1-1.c-ee5cfb2d6306****.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2D6306****.COM.

        [root@core-1-1(xxx) ~]# klist -k $IMPALA_CONF_DIR/impala.keytab
Keytab name: FILE:/etc/taihao-apps/impala-conf/runtime-conf/impala.keytab
KVNO Principal
---- ----------------------------------------------------------------
   2 impala/core-1-1.c-ee5cfb2dxxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2Dxxx.COM
   2 impala/core-1-1.c-ee5cfb2dxxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2Dxxx.COM
   2 impala/core-1-1.c-ee5cfb2dxxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2Dxxx.COM
   2 impala/core-1-1.c-ee5cfb2dxxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2Dxxx.COM
   2 impala/core-1-1.c-ee5cfb2dxxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2Dxxx.COM
   2 impala/core-1-1.c-ee5cfb2dxxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2Dxxx.COM
   2 HTTP/core-1-1.c-ee5cfb2d63xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2D63xxx.COM
   2 HTTP/core-1-1.c-ee5cfb2d63xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2D63xxx.COM
   2 HTTP/core-1-1.c-ee5cfb2d63xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2D63xxx.COM
   2 HTTP/core-1-1.c-ee5cfb2d63xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2D63xxx.COM
   2 HTTP/core-1-1.c-ee5cfb2d63xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2D63xxx.COM
   2 HTTP/core-1-1.c-ee5cfb2d63xxx.cn-hangzhou.emr.aliyuncs.com@EMR.C-EE5CFB2D63xxx.COM

      3. Run the following command to initialize the credential.

        kinit -k -t $IMPALA_CONF_DIR/impala.keytab <principal>
        Note

        Replace <principal> with the principal you recorded in the previous step.

    3. Run the following command as the root user to connect to Impala.

      beeline -u 'jdbc:hive2://<impalad_node_name>:28000/default;principal=<principal>;transportMode=http'

    4. Optional: To exit the Beeline CLI, run the !quit command.

    FAQ

    Where are Impala logs stored?

    Impala logs are stored in the /var/log/taihao-apps/impala/ directory by default. You can log on to a cluster node and navigate to this directory to view the logs.

    Note

    Impala logs are stored on the nodes where Impalad processes run (typically core nodes). If you cannot find logs on a specific node, verify that the Impalad process is deployed on that node.

    How do I query historical access users for Impala?

    If Apache Ranger is not enabled for the cluster, Impala uses Hadoop Distributed File System (HDFS) file read and write permissions for access control.

    To extract historical connection accounts from the audit log, run the following command on a node where the Impalad process is running:

    grep "Successfully authenticated client user" /var/log/taihao-apps/impala/impalad.INFO* | awk -F'"' '{print $2}' | sort | uniq -c | sort -nr

    This command searches the Impala audit logs for successful authentication records, extracts usernames, and displays them in descending order by connection count.

    How do I create a read-only account for Impala?

    Creating a read-only Impala account requires Apache Ranger for permission control. If Ranger is not deployed in your cluster, add the Ranger service before you configure fine-grained access control such as read-only permissions.

    Does Impala on EMR 4.9.0 support Ranger authorization?

    Impala on EMR 4.9.0 does not support Ranger authorization. To use Ranger for Impala permission management, create a cluster that runs a later EMR version and migrate your data to the new cluster.