# AWS ES logstash - Got response code '403' contacting Elasticsearch at URL 'https://search-aws-e\*

**URL:** https://discuss.elastic.co/t/aws-es-logstash-got-response-code-403-contacting-elasticsearch-at-url-https-search-aws-e/212506
**Category:** Logstash
**Created:** [December 19, 2019, 2:48pm UTC](https://discuss.elastic.co/t/aws-es-logstash-got-response-code-403-contacting-elasticsearch-at-url-https-search-aws-e/212506 "2019-12-19T14:48:08Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Kiran\_Kumar2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kiran_kumar2/32/59483_2.png) [@Kiran\_Kumar2](https://discuss.elastic.co/u/Kiran_Kumar2)
#### Post date: [December 19, 2019, 2:48pm UTC](https://discuss.elastic.co/t/aws-es-logstash-got-response-code-403-contacting-elasticsearch-at-url-https-search-aws-e/212506/1 "2019-12-19T14:48:09Z")

</div>

I have configured the AWS ES and logstash. and granted the default full AWS policy(AmazonESFullAccess) to the user still I am getting 403 error.  
my filebeats and logstash are running in same host

here are the configuration property details.

logstash.conf  
input {  
beats {  
port =\> 5044  
codec =\> "json"  
}  
}  
output {  
if [fields][product] == "hive"  
{  
amazon\_es {  
hosts =\> "search-\*\*\*\*\*\*\*\*\*:443"  
region =\> "us-east-1"  
aws\_access\_key\_id =\> 'my\_aws\_access\_key\_id'  
aws\_secret\_access\_key =\> 'my\_aws\_secret\_access\_key'  
index =\> "Hive-logs-%{+YYYY.MM.dd}"  
}  
}  
else  
{  
amazon\_es {  
hosts =\> "END POINT URL FROM AWS ES :443"  
}  
}  
}

my access policy from AWS ES

{  
"Version": "2012-10-17",  
"Statement": [  
{  
"Sid": "",  
"Effect": "Allow",  
"Principal": {  
"AWS": "_"  
},  
"Action": "es:_",  
"Resource": "arn:aws:\*\*\*\*\*\*\*\*/_",  
"Condition": {  
"IpAddress": {  
"aws:SourceIp": [  
"mylogstash\_hostname",  
"__**/32",  
"**_\*/32"  
]  
}  
}  
}  
]  
}

complete error  
[WARN] 2019-12-19 14:36:10.040 [Ruby-0-Thread-6: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"https://search-aws-\*\*\*\*:443/", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '403' contacting Elasticsearch at URL 'https://search-\*\*\*\*\*:443/'"}

Any quick help really appreciated

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 16, 2020, 2:48pm UTC](https://discuss.elastic.co/t/aws-es-logstash-got-response-code-403-contacting-elasticsearch-at-url-https-search-aws-e/212506/2 "2020-01-16T14:48:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.