Authentication of [elastic] was terminated by realm [reserved]

Elastic Stack Elasticsearch
1

My ELK stack is udpated with same version

Elasticsearch version 7.11.1
logstash version 7.11.1
filebeat version 7.11.1

And in elasticsearch.log only thing i am seeing is

[INFO ][o.e.x.s.a.AuthenticationService] [inlxdev02] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
and Filebeat and kibana stopped logging the logs and there's no error in filbeat and kibana log files.
Credential in kibana.yml is correct because logs were working some days ago.

elasticsearch.username: kibana
elasticsearch.password: password

Please guide what should i do in this scenario?

2

Can you connect to Elasticsearch with the elastic user and your password?

3

That's not a lot to go on, but I'll make a best guess.

In your filebeat configuration, what username do you have for connecting to Elasticsearch? It sounds like it's elastic - is that the case?

If so, then it's likely that the password you have there is incorrect. Where did it come from? Is it the result of running elasticsearch-setup-passwords? Or did you configure it in some other way?

Is that really the only thing? No other messages at all?
That makes a big difference - with no other messages, the most likely explanation your elastic password has been changed since you configured filebeat.
But if there are other messages, it could mean that you have a cluster infrastructure problem that is preventing authentication, and we'd need to see those messages to know exactly what that problem is.

4

Thanks for taking out the time.

Below is the screenshot from elasticsearch.log file

image
image1407×956 190 KB

And i have looked into filebeat configuration file, but there's no user called elastic .
I can post the filebeat configration file, if that would help.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.