# Authentication of \[elastic\] was terminated by realm \[reserved\]
**URL:** https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/268307
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [March 25, 2021, 9:04am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/268307 "2021-03-25T09:04:30Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Divyanshu\_Tyagi](https://discuss.elastic.co/u/Divyanshu_Tyagi)
#### Post date: [March 25, 2021, 9:04am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/268307/1 "2021-03-25T09:04:30Z")
My ELK stack is udpated with same version
```
Elasticsearch version 7.11.1
logstash version 7.11.1
filebeat version 7.11.1
```
And in `elasticsearch.log` only thing i am seeing is
`[INFO][o.e.x.s.a.AuthenticationService] [inlxdev02] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]`
and Filebeat and kibana stopped logging the logs and there's no error in filbeat and kibana log files.
Credential in `kibana.yml` is correct because logs were working some days ago.
```
elasticsearch.username: kibana
elasticsearch.password: password
```
Please guide what should i do in this scenario?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 25, 2021, 11:56pm UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/268307/2 "2021-03-25T23:56:50Z")
Can you connect to Elasticsearch with the `elastic` user and your password?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [March 26, 2021, 12:41am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/268307/3 "2021-03-26T00:41:13Z")
That's not a lot to go on, but I'll make a best guess.
In your filebeat configuration, what username do you have for connecting to Elasticsearch? It sounds like it's `elastic` - is that the case?
If so, then it's likely that the password you have there is incorrect. Where did it come from? Is it the result of running `elasticsearch-setup-passwords`? Or did you configure it in some other way?
> [@Divyanshu\_Tyagi](#):
>
> in `elasticsearch.log` only thing i am seeing is
>
> ```auto
> [INFO][o.e.x.s.a.AuthenticationService] [inlxdev02] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
>
> ```
Is that really the _only_ thing? No other messages at all?
That makes a big difference - with no other messages, the most likely explanation your `elastic` password has been changed since you configured filebeat.
But if there are other messages, it could mean that you have a cluster infrastructure problem that is preventing authentication, and we'd need to see those messages to know exactly what that problem is.
---
### Author:  [@Divyanshu\_Tyagi](https://discuss.elastic.co/u/Divyanshu_Tyagi)
#### Post date: [April 5, 2021, 5:51am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/268307/4 "2021-04-05T05:51:01Z")
Thanks for taking out the time.
Below is the screenshot from `elasticsearch.log` file
And i have looked into `filebeat` configuration file, but there's no user called `elastic` .
I can post the `filebeat` configration file, if that would help.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 3, 2021, 5:51am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/268307/5 "2021-05-03T05:51:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.