# Can't get auth to work LS -\> ES
**URL:** https://discuss.elastic.co/t/cant-get-auth-to-work-ls-es/133943
**Category:** Logstash
**Created:** [May 30, 2018, 9:04pm UTC](https://discuss.elastic.co/t/cant-get-auth-to-work-ls-es/133943 "2018-05-30T21:04:32Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@jonrust](https://discuss.elastic.co/u/jonrust)
#### Post date: [May 30, 2018, 9:04pm UTC](https://discuss.elastic.co/t/cant-get-auth-to-work-ls-es/133943/1 "2018-05-30T21:04:32Z")
I can connect using curl (running on cdlelk01):
```
curl -u logstash_system:mypass http://localhost:9200/
{
"name" : ...
```
My outputs have the same user and password:
```
output {
elasticsearch {
hosts => ["cdlelk01:9200","cdlelk02:9200"]
loadbalance => true
index => "dblogs-%{+YYYY.MM.dd}"
user => 'logstash_system'
password => 'mypass'
}
}
```
Is there another place to define this info? I keep getting errors regarding auth:
> [WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://localhost:9200/](http://localhost:9200/)", :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at URL '[http://localhost:9200/](http://localhost:9200/)'"}
Which is odd because it's referencing localhost:9200, which doesn't exist anywhere in my configs. (Same host, tested curl both ways)
---
### Author:  [@jonrust](https://discuss.elastic.co/u/jonrust)
#### Post date: [May 30, 2018, 11:12pm UTC](https://discuss.elastic.co/t/cant-get-auth-to-work-ls-es/133943/2 "2018-05-30T23:12:18Z")
logstash\_system was a bad choice apparently. It doesn't have privileges to write to indexes. It works with the "super user" elastic. I'll dive back into the user docs and straighten it out.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 27, 2018, 11:26pm UTC](https://discuss.elastic.co/t/cant-get-auth-to-work-ls-es/133943/3 "2018-06-27T23:26:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.