# About ingest-geoip error

**URL:** <https://discuss.elastic.co/t/about-ingest-geoip-error/107277>\
**Category:** Elasticsearch\
**Created:** [November 11, 2017, 3:57pm UTC](https://discuss.elastic.co/t/about-ingest-geoip-error/107277 "2017-11-11T15:57:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lljstar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lljstar/32/24100_2.png) [@lljstar](https://discuss.elastic.co/u/lljstar)\
**Post date:** [November 11, 2017, 3:57pm UTC](https://discuss.elastic.co/t/about-ingest-geoip-error/107277/1 "2017-11-11T15:57:00Z")

</div>

if I change the account: elastic password:changeme to a new pasword , the es start will be resport this error:  
if I remeve the plugin ingest-geoip, the es can running have no error; I think the ingest-geoip must be set the account:elastic and new password.but i can't the ingest-geoip config doc where i can setting

[2017-11-11T23:37:42,935][ERROR][o.e.x.s.a.e.NativeUsersStore] [xItirib] failed to retrieve built in user [elastic] info  
org.elasticsearch.action.NoShardAvailableActionException: No shard available for [get [.security][reserved-user][elastic]: routing [null]]  
at org.elasticsearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction.perform(TransportSingleShardAction.java:209) ~[elasticsearch-5.6.3.jar:5.6.3]  
at org.elasticsearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction.onFailure(TransportSingleShardAction.java:196) ~[elasticsearch-5.6.3.jar:5.6.3]  
at pport.single.shard.TransportSingleShardAction$ShardTransportHandler.messageReceived(TransportSingleShardAction.java:294) ~[elasticsearch-5.6.3.jar:5.6.3]  
at org.elasticsearch.action.support.single.shard.TransportSingleShardAction$ShardTransportHandler.messageReceived(TransportSingleShardAction.java:287) ~[elasticsearch-5.6.3.jar:5.6.3]  
at org.elasticsearch.transport.TransportRequestHandler.messageReceived(TransportRequestHandler.java:33) ~[elasticsearch-5.6.3.jar:5.6.3]  
at org.elasticsearch.xpack.security.transport.SecurityServerTransportInterceptor$ProfileSecuredRequestHandler$1.doRun(SecurityServerTransportInterceptor.java:258) ~[?:?]  
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-5.6.3.jar:5.6.3]  
... 25 more  
[2017-11-11T23:37:42,984][ERROR][o.e.x.s.a.e.ReservedRealm] [xItirib] failed to retrieve password hash for reserved user [elastic]  
[2017-11-11T23:37:42,985][WARN][o.e.x.s.a.AuthenticationService] [xItirib] An error occurred while attempting to authenticate [elastic] against realm [reserved] - ElasticsearchSecurityException[failed to authenticate user [elastic]]  
[2017-11-11T23:37:43,768][INFO][o.e.c.r.a.AllocationService] [xItirib] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[.monitoring-es-6-2017.11.11][0]] ...]).  
^C[2017-11-11T23:37:49,663][INFO][o.e.x.m.j.p.NativeController] Native controller process has stopped - no new native processes can be started

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 11, 2017, 4:29pm UTC](https://discuss.elastic.co/t/about-ingest-geoip-error/107277/2 "2017-11-11T16:29:09Z")

</div>

Thanks for reporting. May I ask that you format the post?

I moved the question to #x-pack group.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [November 11, 2017, 9:52pm UTC](https://discuss.elastic.co/t/about-ingest-geoip-error/107277/3 "2017-11-11T21:52:28Z")

</div>

The issue you have is that something is trying to authenticate as `elastic` while your server is starting up and hasn't recovered its indices yet.

There's not enough information to know what process is triggering that authentication attempt.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 9, 2017, 9:52pm UTC](https://discuss.elastic.co/t/about-ingest-geoip-error/107277/4 "2017-12-09T21:52:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.