# Couldn't connect to AWS ES

**URL:** <https://discuss.elastic.co/t/couldnt-connect-to-aws-es/193294>\
**Category:** Beats\
**Created:** [August 1, 2019, 10:22am UTC](https://discuss.elastic.co/t/couldnt-connect-to-aws-es/193294 "2019-08-01T10:22:53Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![sv\_bcvt92](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@sv\_bcvt92](https://discuss.elastic.co/u/sv_bcvt92)\
**Post date:** [August 1, 2019, 10:22am UTC](https://discuss.elastic.co/t/couldnt-connect-to-aws-es/193294/1 "2019-08-01T10:22:54Z")

</div>

Hi Gurus,  
I'm setting Filebeat to send nginx logs to AWS Elasticsearch service. I do follow exactly this guide

 ![filebeat](https://us1.discourse-cdn.com/elastic/original/3X/3/7/377628bcf58fabec96843e0b5bb37745aecee442.png)  
But in step 4, I got this error

> Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch [https://search-abcxyz.ap-northeast-1.es.amazonaws.com:443](https://search-abcxyz.ap-northeast-1.es.amazonaws.com:443): 403 Forbidden: {"message":"'ZWxhc3RpYzpIYW5vaUAyMDE5' not a valid key=value pair (missing equal-sign) in Authorization header: 'Basic ZWxhc3RpYzpIYW5vaUAyMDE5'."}]

filebeat.yml:

```
filebeat.inputs:
- type: log

  # Change to true to enable this input configuration.
  enabled: false

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/nginx/*.log

setup.kibana:
  host: "https://search-abcxyz.ap-northeast-1.es.amazonaws.com:443/_plugin/kibana/"
output.elasticsearch:
  hosts: ["https://search-abcxyz.ap-northeast-1.es.amazonaws.com:443"]
  # Enabled ilm (beta) to use index lifecycle management instead daily indices.
  #ilm.enabled: false
  # Optional protocol and basic auth credentials.
  #protocol: "https"
  username: "elastic"
  password: "xxxxxx"

```

Can anyone help me on this problem?  
Thanks.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 1, 2019, 11:39am UTC](https://discuss.elastic.co/t/couldnt-connect-to-aws-es/193294/2 "2019-08-01T11:39:22Z")

</div>

Does AWS ES support HTTPS basic auth? Can you curl from that host to your Elasticsearch cluster?

---

<div class="post-metadata">

**Author:** ![sv\_bcvt92](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@sv\_bcvt92](https://discuss.elastic.co/u/sv_bcvt92)\
**Post date:** [August 1, 2019, 2:55pm UTC](https://discuss.elastic.co/t/couldnt-connect-to-aws-es/193294/3 "2019-08-01T14:55:19Z")

</div>

Hi Christian,

I dont know if AWS ES supports basic auth or not.  
I try with this command  
`curl --user elastic:xxxxxx "https://search-abcxyz.ap-northeast-1.es.amazonaws.com/"`  
then I get the response:  
`{"message":"'ZWxhc3RpYzpIYW5vaUAyMDE5' not a valid key=value pair (missing equal-sign) in Authorization header: 'Basic ZWxhc3RpYzpIYW5vaUAyMDE5'."}`

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 1, 2019, 2:57pm UTC](https://discuss.elastic.co/t/couldnt-connect-to-aws-es/193294/4 "2019-08-01T14:57:31Z")

</div>

Seems like it does not so you may have to go through Logstash where you can install a specific AWS ES output plugin.

---

<div class="post-metadata">

**Author:** ![sv\_bcvt92](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@sv\_bcvt92](https://discuss.elastic.co/u/sv_bcvt92)\
**Post date:** [August 1, 2019, 3:06pm UTC](https://discuss.elastic.co/t/couldnt-connect-to-aws-es/193294/5 "2019-08-01T15:06:56Z")

</div>

Thanks for your time, Christian.  
If anyone centralizes nginx logs from EC2 to AWS ES before, please advise me.  
Ah, I forgot to tell you that I used Amazon Cognito for AWS ES authentication.

Many thanks.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 1, 2019, 3:14pm UTC](https://discuss.elastic.co/t/couldnt-connect-to-aws-es/193294/6 "2019-08-01T15:14:32Z")

</div>

I have not used AWS ES but did not have similar problems with Elastic Cloud, which does support HTTPS and basic auth.

---

<div class="post-metadata">

**Author:** ![sv\_bcvt92](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@sv\_bcvt92](https://discuss.elastic.co/u/sv_bcvt92)\
**Post date:** [August 1, 2019, 3:19pm UTC](https://discuss.elastic.co/t/couldnt-connect-to-aws-es/193294/7 "2019-08-01T15:19:39Z")

</div>

Christian,  
I can also disable Cognito authentication for AWS ES, but I'm afraid that its security will be quite weak.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 29, 2019, 5:21pm UTC](https://discuss.elastic.co/t/couldnt-connect-to-aws-es/193294/8 "2019-08-29T17:21:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.