Apm-server failed connect to ElasticSearch with Xpack enabled (401 Unauthorized )



On my docker environment, I can not connect apm-server with elastic Search when xpack (basic mode) is enabled. When Xpack is disabled, it's work

ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(http://elasticsearch:9200)): 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401}

While Kibana connects well with Elastic Search with Xpack (basic mode) enabled.


xpack.license.self_generated.type: basic
xpack.security.enabled: true


xpack.security.enabled: true
elasticsearch.username: elastic
elasticsearch.password: changeme


  host: localhost:8200

    enabled: true
    protocol: "http"
    hosts: [ "elasticsearch:9200" ]
    ssl.enabled: false
    username: elastic
    password: changeme

How can I connect apm-server to elastic Search with Basic Authentication?

Thx !

1 Like

Hey @blump, thanks for joining the forum. Are you able to log into kibana with those credentials? If so, you might consider enabling security audting in elasticsearch and expect the elasticsearch logs to point you in the right direction.

I don't see anything obviously wrong with the apm-server.yml provided.

Hi Gil, I have the same case. Can there be a problem in the type of license?

Checked, the problem is not in the license.


I have the same issue!
Would you mind let us know how you solved it?

Can you provide your docker-compose for apm-server?

Actually I have this similar issue in Metricbeats with this docker-compose file:

version: "2.1"
    container_name: metricbeat
    hostname: metricbeat
    user: root
    image: docker.elastic.co/beats/metricbeat:${ELASTIC_VERSION}
      - ./config/beats/metricbeat/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml
      - ./config/beats/metricbeat/modules.d/:/usr/share/metricbeat/modules.d/
      - /proc:/hostfs/proc:ro
      - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - /:/hostfs:ro
    command: metricbeat -e -system.hostfs=/hostfs -E output.elasticsearch.username=elastic -E output.elasticsearch.password=xxxx -strict.perms=false
    restart: on-failure

My problem was exactly the same as Mr. Blumb. The solution was simple, the configuration was mounted the wrong way. I do not use metricbeat. But I suggest you not to use the command to pass arguments, but to do it in the config.

Thanks, I have the same issue!
I removed any parameters from docker-compose command and just used config to pass arguments (elastic user and pass).

I did not have time to look again at this problem. I do not pass my arguments by a command. I could look again at the problem in September.

Good luck to you.

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.