# Can't get logstash user to authenticate to ES
**URL:** https://discuss.elastic.co/t/cant-get-logstash-user-to-authenticate-to-es/47990
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [April 21, 2016, 4:00am UTC](https://discuss.elastic.co/t/cant-get-logstash-user-to-authenticate-to-es/47990 "2016-04-21T04:00:59Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@bluethundr](https://discuss.elastic.co/u/bluethundr)
#### Post date: [April 21, 2016, 4:00am UTC](https://discuss.elastic.co/t/cant-get-logstash-user-to-authenticate-to-es/47990/1 "2016-04-21T04:00:59Z")
Hey guys,
I have a user setup with the logstash role:
> [root@logs:~] #esusers list|grep ls\_admin
> ls\_admin : logstash
I've got him defined in my elasticsearch section of my output filter:
> output {
> elasticsearch {
> hosts =\> ["xxx.xxx.xx.xxx:9200", "xx.xx.xx.xxx:9200", "xx.xx.xx.xx:9200"]
> user =\> "ls\_admin"
> password =\> "secret"
> }
And in my roles.yml fie I have my logstash role defined defined this way:
> ## The required role for logstash users
>
> logstash:
> cluster:
> - manage\_index\_templates
> indices:
> - names: 'logstash-\*'
> privileges:
> - write
> - read
> - create\_index
> - cluster:monitor/nodes/info
> - cluster:monitor/health
Restarted elasticsearch. And I am still unable to create indexes with the ls\_admin user and I am still unable to access the monitoring API's.
> [root@logs:~] #curl -u ls\_admin:$ES\_PASS localhost:9200/test\_index -XPUT
> {"error":{"root\_cause":[{"type":"security\_exception","reason":"action [indices:admin/create] is unauthorized for user [ls\_admin]"}],"type":"security\_exception","reason":"action [indices:admin/create] is unauthorized for user [ls\_admin]"},"status":403}[root@logs:~] #
> [root@logs:~] #curl -u ls\_admin:$ES\_PASS localhost:9200/\_cluster/health?pretty
> {
> "error" : {
> "root\_cause" : [ {
> "type" : "security\_exception",
> "reason" : "action [cluster:monitor/health] is unauthorized for user [ls\_admin]"
> } ],
> "type" : "security\_exception",
> "reason" : "action [cluster:monitor/health] is unauthorized for user [ls\_admin]"
> },
> "status" : 403
> }
What am I doing wrong and how can I correct this?
Thanks
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [April 21, 2016, 11:42am UTC](https://discuss.elastic.co/t/cant-get-logstash-user-to-authenticate-to-es/47990/2 "2016-04-21T11:42:14Z")
The two apis that you tried to use are not authorized for the logstash user based on the role.
Maybe try `curl -u ls_admin:$ES_PASS localhost:9200/logstash-test -XPUT` and see if that works. This way we can tell if they user is working.
---
### Author:  [@bluethundr](https://discuss.elastic.co/u/bluethundr)
#### Post date: [April 21, 2016, 5:03pm UTC](https://discuss.elastic.co/t/cant-get-logstash-user-to-authenticate-to-es/47990/3 "2016-04-21T17:03:22Z")
> [@jaymode](#):
>
> The two apis that you tried to use are not authorized for the logstash user based on the role.
>
> Maybe try curl -u ls\_admin:$ES\_PASS localhost:9200/logstash-test -XPUT and see if that works. This way we can tell if they user is working.
Yeah I just tried that and it's still not working!
```
[root@logs:~] #curl -u ls_admin:$ES_PASS localhost:9200/logstash-test -XPUT
{"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:admin/create] is unauthorized for user [ls_admin]"}],"type":"security_exception","reason":"action [indices:admin/create] is unauthorized for user [ls_admin]"},"status":403}
```
Any ideas how I can correct this?
---
### Author:  [@devday](https://discuss.elastic.co/u/devday)
#### Post date: [February 13, 2017, 11:05am UTC](https://discuss.elastic.co/t/cant-get-logstash-user-to-authenticate-to-es/47990/4 "2017-02-13T11:05:50Z")
Did you manage to find a solution for this?
I've got the same issue.
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [February 13, 2017, 11:30pm UTC](https://discuss.elastic.co/t/cant-get-logstash-user-to-authenticate-to-es/47990/5 "2017-02-13T23:30:27Z")
> [@devday](#):
>
> I've got the same issue.
Please start a new thread for your issue, and provide as much detail as you can.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:41pm UTC](https://discuss.elastic.co/t/cant-get-logstash-user-to-authenticate-to-es/47990/6 "2017-07-06T13:41:18Z")