# Could not execute action: PipelineAction::Create\<main\> after xpack.security enabled

**URL:** https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861
**Category:** Logstash
**Tags:** elastic-stack-security
**Created:** [October 30, 2020, 8:14pm UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861 "2020-10-30T20:14:59Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![ASA01](https://avatars.discourse-cdn.com/v4/letter/a/e19adc/32.png) [@ASA01](https://discuss.elastic.co/u/ASA01)
#### Post date: [October 30, 2020, 8:14pm UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861/1 "2020-10-30T20:14:59Z")

</div>

Logstash works fine for me until I enable xpack security in elasticsearch.yml. When I do I get the following error from any conf that creates indices.

[ERROR] 2020-10-30 15:52:06.741 [Converge PipelineAction::Create] agent - Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, action\_result: false", :backtrace=\>nil}

My confs that are not creating new indices and use a set index name still work fine.

Here is an example of a failing conf

```auto
    output {
   elasticsearch {
      hosts => ["localhost:9200"]
      index => "adminskillchange-%{+YYYY.MM.dd}"
      document_id => "%{skchg_acd}_%{skchg_user}_%{skchg_logid}_%{skchg_date}"
      manage_template => false
      user => "logstash_internal"
      password => " ********"
   }
   stdout { codec => rubydebug }
}

```

I have tried setting cluster privileges and indices privileges to all and it's doesn't help.

Currently my role for logstash\_internal has:  
Cluster: monitor, manage\_index\_templates  
Indices: write, delete, create\_index, create

I have the following in my logstash.yml  
xpack.monitoring.enabled: true  
xpack.monitoring.elasticsearch.username: logstash-internal  
xpack.monitoring.elasticsearch.password: \*\*\*\*\*\*

OS: CentOS ELK: 7.9.3

Any assistance is greatly appreciated.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 30, 2020, 8:29pm UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861/2 "2020-10-30T20:29:00Z")

</div>

Try setting log.level to debug. You may get a more informative message.

---

<div class="post-metadata">

### Author: ![ASA01](https://avatars.discourse-cdn.com/v4/letter/a/e19adc/32.png) [@ASA01](https://discuss.elastic.co/u/ASA01)
#### Post date: [November 1, 2020, 12:08am UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861/3 "2020-11-01T00:08:08Z")

</div>

```auto
[2020-10-31T20:02:30,831][ERROR][logstash.javapipeline][main] Pipeline error {:pipeline_id=>"main", :exception=>#<Elasticsearch::Transport::Transport::Errors::Unauthorized: [401] >, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/base.rb:202:in `__raise_transport_error'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/base.rb:319:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/http/manticore.rb:67:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/client.rb:131:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-api-5.0.5/lib/elasticsearch/api/actions/ping.rb:20:in `ping'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.9.0/lib/logstash/filters/elasticsearch.rb:310:in `test_connection!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.9.0/lib/logstash/filters/elasticsearch.rb:117:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:586:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:240:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in `block in start'"], "pipeline.sources"=>["/etc/logstash/conf.d/ech.conf"], :thread=>"#<Thread:0x753a8cd4 run>"}
[2020-10-31T20:02:30,844][INFO][logstash.javapipeline][main] Pipeline terminated {"pipeline.id"=>"main"}
[2020-10-31T20:02:30,862][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

```

I am guessing the error lies in the 401. However I am not sure why I am getting this. I have verified with curl that the login/password are good.

Tail of my conf looks like...

```auto
elasticsearch {
      hosts => ["http://localhost:9200"]
      index => "ech-%{+YYYY.MM.dd}"
      document_id => "%{acd}_%{callid}_%{segment}_%{ucid}"
      manage_template => false
      user => "logstash_internal"
      password => " ******"
   }

```

logstash.yml:

```auto
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: logstash_internal
xpack.monitoring.elasticsearch.password: ******
xpack.monitoring.elasticsearch.hosts: ["http://localhost:9200"]

```

elasticsearch.yml:

```auto
xpack:
   security:
      enabled: true

discovery.type: single-node

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 1, 2020, 12:26am UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861/4 "2020-11-01T00:26:55Z")

</div>

> [@ASA01](#):
>
> I am guessing the error lies in the 401.

Agreed. The code is getting an exception [here](https://github.com/elastic/elasticsearch-ruby/blob/b8a45dc2ff810bc83f54c9f1e91cefdc03a25413/elasticsearch-api/lib/elasticsearch/api/actions/ping.rb#L20). Whilst the username and password may be valid, perhaps they do not have the appropriate permissions/role. It is really an elasticsearch question now, not a logstash question.

---

<div class="post-metadata">

### Author: ![ASA01](https://avatars.discourse-cdn.com/v4/letter/a/e19adc/32.png) [@ASA01](https://discuss.elastic.co/u/ASA01)
#### Post date: [November 1, 2020, 12:28am UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861/5 "2020-11-01T00:28:42Z")

</div>

I finally figured out what is causing the error. I have the following higher up in my conf file.

```auto
  elasticsearch {
     hosts => ["localhost:9200"]
     index => ["synonyms"]
     result_size => 1
     query => "_id:%{[acd]}_split_%{[split3]}"
     fields => { "item_name" => "split3name"}
  }

```

These are kicking out the 401s. If I add

```auto
user => "${ES_USER}"
password => "${ES_PWD}"

```

final version

```auto
elasticsearch {
      hosts => ["localhost:9200"]
      index => ["synonyms"]
      result_size => 1
      query => "_id:%{[acd]}_split_%{[split1]}"
      fields => { "item_name" => "split1name"}
      user => "${ES_USER}"
      password => "${ES_PWD}"
   }

```

It starts working. I really appreciate your help. Thank you.

---

<div class="post-metadata">

### Author: ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [November 2, 2020, 3:06am UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861/6 "2020-11-02T03:06:12Z")

</div>

> [@ASA01](#):
>
> I am guessing the error lies in the 401

A `401` is an authentication failure. There is insufficient information for anyone to diagnose this from what you have posted, but checking the Elasticsearch logs might provide more details.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 30, 2020, 3:06am UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861/7 "2020-11-30T03:06:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.