# Connection to ES nodes can only be made with Elastic Superuser 401 Error **URL:** \ **Category:** Logstash\ **Tags:** elastic-stack-security\ **Created:** [December 14, 2018, 7:02pm UTC](https://discuss.elastic.co/t/connection-to-es-nodes-can-only-be-made-with-elastic-superuser-401-error/160957 "2018-12-14T19:02:21Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Ryan\_Downey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_downey/32/35987_2.png) [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Post date:** [December 14, 2018, 7:02pm UTC](https://discuss.elastic.co/t/connection-to-es-nodes-can-only-be-made-with-elastic-superuser-401-error/160957/1 "2018-12-14T19:02:22Z")
Elastic version 6.5.1 on RPM I've been working on our encrypted Logstash to Elasticsearch connection and the only way I can get it to work is by using our elastic user (superuser roles). I've followed the instructions in the documentation on creating a logstash\_internal user and I am unable to get that user to connect. The error that I keep getting with the logstash\_internal user is: ```auto [WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://logstash_internal:xxxxxx@xx.xxx.xx.xxx:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'https://" ``` Heres what I have for my users by running GET \_xpack/security/user ```auto "logstash_user" : { "username" : "logstash_user", "roles" : [ "logstash_reader", "logstash_admin" ], "full_name" : "Kibana User for Logstash", "email" : null, "metadata" : { }, "enabled" : true }, "logstash_internal" : { "username" : "logstash_internal", "roles" : [ "logstash_writer" ], "full_name" : "Internal Logstash User", "email" : null, "metadata" : { }, "enabled" : true }, ``` This is what I get when I run GET \_xpack/security/role ```auto "logstash_reader" : { "cluster" : [], "indices" : [ { "names" : [ "logstash-*" ], "privileges" : [ "read", "view_index_metadata" ] } ], "applications" : [], "run_as" : [], "metadata" : { }, "transient_metadata" : { "enabled" : true } }, "logstash_writer" : { "cluster" : [ "manage_index_templates", "monitor" ], "indices" : [ { "names" : [ "logstash-*" ], "privileges" : [ "write", "delete", "create_index" ] } ], ``` Heres our Logstash config: ```auto input { beats { port => 5044 } } output { elasticsearch { hosts => ["https://xx.xxx.xx.xxx:9200"] manage_template => false index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" user => "logstash_internal" password => "xxxxxxxxx" ssl => true cacert => "/etc/logstash/ca.crt" } } ``` Seems like everything should be set to use logstash\_internal to access our ES cluster but the 401 errors continue. I'd say its a config problem but as mentioned earlier the system has no problems with our elastic user running with the superuser role. Any help would be appreciated and enjoy your day. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [December 19, 2018, 3:33pm UTC](https://discuss.elastic.co/t/connection-to-es-nodes-can-only-be-made-with-elastic-superuser-401-error/160957/2 "2018-12-19T15:33:39Z")
Hello, Can you please verify that the password you are using for `logstash_internal` is the correct one? You can use the `_authenticate` API as follows: ```auto curl -ulogstash_internal:xxxxxxxx -X GET "https://xx.xxx.xx.xxx:9200/_xpack/security/_authenticate" ``` Also, what is your authentication realm configuration in Elasticsearch? Can you share the relevant part of your `elasticsearch.yml`? The `logstash_internal` user belongs in the native realm. Is the [native realm](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-native-realm.html) enabled in Elasticsearch ? `elastic` is one of our [built-in users](https://www.elastic.co/guide/en/elastic-stack-overview/6.5/built-in-users.html) so it will always be enabled, regardless of the realm configuration you have and that might explain why it works when using that in the elasticsearch output plugin of logstash. ---
**Author:** ![Ryan\_Downey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_downey/32/35987_2.png) [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Post date:** [December 20, 2018, 7:38pm UTC](https://discuss.elastic.co/t/connection-to-es-nodes-can-only-be-made-with-elastic-superuser-401-error/160957/3 "2018-12-20T19:38:29Z")
Ioannis, Setting up the Native realm in the elasticsearch.yml did the trick. I was under the impression that the Native realm was enabled by default but was clearly incorrect. It's available by default not enabled by default, big difference. For others to learn from I've posted what my configs have ended up looking like for Logstash and Elasticsearch (part of them). Logstash ```auto input { beats { port => 5044 } } output { elasticsearch { hosts => ["https://xx.xxx.xx.xxx:9200"] manage_template => false index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" user => "logstash_internal" password => "Password" ssl => true cacert => "/etc/logstash/ca.crt" } } ``` Elasticsearch ```auto ###The settings below would be used if we implement --pem formated CA, certs and keys. -Ryan xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.key: /etc/elasticsearch/abc.key xpack.security.transport.ssl.certificate: /etc/elasticsearch/abc.crt xpack.security.transport.ssl.certificate_authorities: ["/etc/elasticsearch/ca.crt"] # ###Enable TLS and specify the information required to access the nodes certificate. ###The settings below would be used if we implement --pem formated CA, certs and keys. -Ryan xpack.security.http.ssl.enabled: true xpack.security.http.ssl.key: /etc/elasticsearch/abc.key xpack.security.http.ssl.certificate: /etc/elasticsearch/abc.crt xpack.security.http.ssl.certificate_authorities: ["/etc/elasticsearch/ca.crt"] ###These are the settings we need to configure and implement for the Native realm. -Ryan 2018/12/20 xpack.security.authc.realms.native1: type: native order: 0 ``` Appreciate your time Ioannis!!! ---
**Author:** ![Ryan\_Downey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_downey/32/35987_2.png) [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Post date:** [January 10, 2019, 7:49pm UTC](https://discuss.elastic.co/t/connection-to-es-nodes-can-only-be-made-with-elastic-superuser-401-error/160957/4 "2019-01-10T19:49:13Z")
Loannis, I fixed this a while ago but there ended up being an extra step to this that other users may need to apply. I had to add the metricbeat-\* indices to the logstash\_writer role in order for anything metricbeat related to appear, even when using elastic as a superuser. The logstash\_admin\_user account also had the logstash\_writer role. In the Kibana GUI I just went into Management--\>Roles--\>logstash\_writer and where the indices are I just added metricbeat-\* (write, delete, create index) and data started populating. You might have to click on the + Add Index Privilege to add the index depending on Kibana GUI. Hopefully this points people in the right direction if they run across this problem. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 7, 2019, 7:49pm UTC](https://discuss.elastic.co/t/connection-to-es-nodes-can-only-be-made-with-elastic-superuser-401-error/160957/5 "2019-02-07T19:49:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.