401 Unauthorized : unable to authenticate user when local metricbeats tries to connect to dockerized ELK

[drjosephliu (Joseph Liu)]

Hi, I'm very new to ELK and could really do with some help.

I've installed dockerized ELK on my computer and started it up with default configuration using docker-compose up -d. The default config uses username elastic and password changeme.

In addition, I've installed non-dockerized metricbeat on my local and set the metricbeat.yml file with the following:

metricbeat.modules:
- module: system
  metricsets:
    - cpu
    - filesystem
    - memory
    - network
    - process
  enabled: true
  period: 10s
  processes: ['.*']
  cpu_ticks: false

fields:
  env: dev

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]
  user: "elastic:"
  password: "changeme"

and started it with the following command:
./metricbeat -e -c metricbeat.yml -d "publish"

Despite setting the credentials in the metricbeat.yml file, I'm still getting the following error:

2020/06/18 02:44:21.914610 output.go:74: ERR Failed to connect: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [] for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"unable to authenticate user [] for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}