# Authentication Exception
**URL:** https://discuss.elastic.co/t/authentication-exception/302177
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [April 12, 2022, 6:27am UTC](https://discuss.elastic.co/t/authentication-exception/302177 "2022-04-12T06:27:18Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Farid\_N](https://discuss.elastic.co/u/Farid_N)
#### Post date: [April 12, 2022, 6:27am UTC](https://discuss.elastic.co/t/authentication-exception/302177/1 "2022-04-12T06:27:18Z")
Hi dears
I have 4nodes of Elasticsearch 7.16.2 and 1node with Kibana, apm-server and Metricbeat. There are 3 instances of Logstash running on Elasticsearch nodes (3 of 4 servers have both ES and Logstash)
My cluster works properly and there is no problem, and also, I didn't change anything but all my Elasticsearch logs is like:
```auto
root-elk-lnx101$:~$ tail -n 15 /var/log/elasticsearch/LogSummerize.log
[2022-04-12T10:43:51,902][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:44:42,549][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:45:33,339][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:46:23,956][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:47:14,695][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:48:05,521][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:48:56,205][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:49:46,836][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:50:37,572][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:51:28,403][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:52:19,275][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:53:10,054][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:54:00,812][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:54:51,540][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
[2022-04-12T10:55:42,292][INFO][o.e.x.s.a.RealmsAuthenticator] [elk-lnx101] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
```
Everything is working!!! Every application's log is OK!
Where is the problem?
Thanks
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [April 12, 2022, 7:56am UTC](https://discuss.elastic.co/t/authentication-exception/302177/2 "2022-04-12T07:56:26Z")
Something it try to authenticate to your ES node using the `elastic` user and an incorrect password.
Did you change the password for the `elastic` use recently? If so, it looks like something is using the old password.
---
### Author:  [@Farid\_N](https://discuss.elastic.co/u/Farid_N)
#### Post date: [April 12, 2022, 11:18am UTC](https://discuss.elastic.co/t/authentication-exception/302177/3 "2022-04-12T11:18:43Z")
Found it
One of the Logstash instances had wrong password in it keystore
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2022, 11:19am UTC](https://discuss.elastic.co/t/authentication-exception/302177/4 "2022-05-10T11:19:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.