Can't get auth to work LS -> ES

[jonrust]

I can connect using curl (running on cdlelk01):

curl -u logstash_system:mypass http://localhost:9200/
{
  "name" : ...

My outputs have the same user and password:

output {
   elasticsearch {
      hosts => [ "cdlelk01:9200","cdlelk02:9200" ]
      loadbalance => true
      index => "dblogs-%{+YYYY.MM.dd}"
      user  => 'logstash_system'
      password => 'mypass'
   }
}

Is there another place to define this info? I keep getting errors regarding auth:

[WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://localhost:9200/", :error_type=>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://localhost:9200/'"}

Which is odd because it's referencing localhost:9200, which doesn't exist anywhere in my configs. (Same host, tested curl both ways)

[jonrust]

logstash_system was a bad choice apparently. It doesn't have privileges to write to indexes. It works with the "super user" elastic. I'll dive back into the user docs and straighten it out.