# Could not index event to Elasticsearch - Logstash with auth
**URL:** https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-logstash-with-auth/201286
**Category:** Logstash
**Created:** [September 26, 2019, 5:39pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-logstash-with-auth/201286 "2019-09-26T17:39:30Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@SirJune](https://discuss.elastic.co/u/SirJune)
#### Post date: [September 26, 2019, 5:39pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-logstash-with-auth/201286/1 "2019-09-26T17:39:30Z")
Hi,
This is related to my previous posts about LON and LAT. Anyway, i tried adding basic authentication in my stack. Filebeat works with authentication. I followed the docs (7.3) to setup Logstash, one config is not working:
output {
elasticsearch {
hosts =\> ["elk21:9200"]
index =\> "logstash-testdmgw-%{host}-%{+YYYY.MM.dd}"
document\_id =\> "%{host}-%{uuid}"
user =\> logstash\_internal
password =\> \*\*\*\*\*\*\*\*\*\*\*
}
stdout { codec =\> rubydebug }
}
The above gives out:
[2019-09-26T13:16:32,538][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>"server06.bogo.mysite.com-c11c5ce5-f73a-4fd4-a5b1-aca8efd83906",
:\_index=\>"logstash-testxmgw-server06.bogo.mysite.com-2019.09.26", :\_type=\>"\_doc", :routing=\>nil}, #LogStash::Event:0x34a4a3d1],
:response=\>{"index"=\>{"\_index"=\>"logstash-testxmgw-server06.bogo.mysite.com-2019.09.26", "\_type"=\>"\_doc", "\_id"=\>"server06.bogo.mysite.com-c11c5ce5-f73a-4fd4-a5b1-aca8efd83906",
"status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"The [default] mapping cannot be updated on index [logstash-testxmgw-server06.bogo.mysite.com-2019.09.26]
: defaults mappings are not useful anymore now that indices can have at most one type."}}}}
/apps/logstash/vendor/bundle/jruby/2.5.0/gems/awesome\_print-1.7.0/lib/awesome\_print/formatters/base\_formatter.rb:31: warning: constant ::Fixnum is deprecated
If i change the index name to : bogo-testdmgw-%{host}-%{+YYYY.MM.dd}, it works. I had the role privileges with bogo-\* and logstash-\*
I had searched the forum and a solution mentioned is to delete the logstash template, restart logstash and it will re-create the template?
Is there a fix without deleting the default logstash template? or is there a way to copy the logstash default template to another template name, let say "bogo".
I'd appreciate any help and advise.
thanks,
sirjune
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 24, 2019, 5:39pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-logstash-with-auth/201286/2 "2019-10-24T17:39:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.