# Action \[indices:data/write/bulk\] is unauthorized for user \[logstash\_system\]\\

**URL:** https://discuss.elastic.co/t/action-indices-data-write-bulk-is-unauthorized-for-user-logstash-system/95532
**Category:** Logstash
**Created:** [August 2, 2017, 1:12pm UTC](https://discuss.elastic.co/t/action-indices-data-write-bulk-is-unauthorized-for-user-logstash-system/95532 "2017-08-02T13:12:39Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![dencowboy](https://avatars.discourse-cdn.com/v4/letter/d/c67d28/32.png) [@dencowboy](https://discuss.elastic.co/u/dencowboy)
#### Post date: [August 2, 2017, 1:12pm UTC](https://discuss.elastic.co/t/action-indices-data-write-bulk-is-unauthorized-for-user-logstash-system/95532/1 "2017-08-02T13:12:39Z")

</div>

I've created the ELK stack in docker.  
I started ES. I've changed the password of the existing logstash\_system user:

```
curl -u elastic -XPUT 'localhost:9200/_xpack/security/user/logstash_system/_password?pretty' -H 'Content-Type: application/json' -d'
{
  "password": "secretlog"
}

```

I've created my own logstash image with as .yml

```
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.elasticsearch.password: secretlog

```

pipeline/logstash.conf looks like:

```
input {
  gelf { }
}

output {
  elasticsearch {
    hosts => ["http://elasticsearch:9200"]
    user => "logstash_system"
    password => "secretlog"
  }
  stdout { }
}

```

Now i've started a container with the gelf driver. I see the logs in my logstash but it's also throwing this error in between:

```
2017-08-02T12:49:51.239Z 172.17.0.1 - - [02/Aug/2017:12:49:51 +0000] "GET / HTTP/1.1" 200 45
[2017-08-02T12:49:51,394][ERROR][logstash.outputs.elasticsearch] Got a bad response code from server, but this code is not considered retryable. Request will be dropped {:code=>403, :response_body=>"{\"error\":{\"root_cause\":[{\"type\":\"security_exception\",\"reason\":\"action [indices:data/write/bulk] is unauthorized for user [logstash_system]\"}],\"type\":\"security_exception\",\"reason\":\"action [indices:data/write/bulk] is unauthorized for user [logstash_system]\"},\"status\":403}"}
2017-08-02T12:49:51.362Z 172.17.0.1 - - [02/Aug/2017:12:49:51 +0000] "GET / HTTP/1.1" 200 45

```

This does not work: I go inside my logstash container and try to curl indices:

```
$:~/logging-project$ docker exec -it c187363f5729 bash
bash-4.2$ curl -u logstash_system 'elasticsearch:9200/_cat/indices?v'
Enter host password for user 'logstash_system':
{"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:monitor/stats] is unauthorized for user [logstash_system]"}],"type":"security_exception","reason":"action [indices:monitor/stats] is unauthorized for user [logstash_system]"},"status":403}bash-4.2$
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 30, 2017, 1:12pm UTC](https://discuss.elastic.co/t/action-indices-data-write-bulk-is-unauthorized-for-user-logstash-system/95532/2 "2017-08-30T13:12:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.