# Creating processor \[set\_security\_user\] (tag \[null\]) on field \[\_security\] but authentication is not currently enabled

**URL:** <https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [May 5, 2022, 10:27am UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020 "2022-05-05T10:27:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elephant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elephant/32/103014_2.png) [@elephant](https://discuss.elastic.co/u/elephant)\
**Post date:** [May 5, 2022, 10:27am UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020/1 "2022-05-05T10:27:41Z")

</div>

Hi,

I get this WARN in loop in our elastic logs. How can I disable them? We are inside dockers and don't want/need to enable authentication.

{"@timestamp":"2022-05-05T10:24:53.093Z", "log.level": "WARN", "message":"Creating processor [set\_security\_user] (tag [null]) on field [\_security] but authentication is not currently enabled on this cluster - this processor is likely to fail at runtime if it is used", "ecs.version": "1.2.0","service.name":"ES\_ECS","event.dataset":"Elasticsearch.server","process.thread.name":"Elasticsearch[elastic][generic][T#6]","log.logger":"org.Elasticsearch.xpack.security.ingest.SetSecurityUserProcessor","Elasticsearch.cluster.uuid":"CEHMs-OgRjONd7n3Y6zF3g","Elasticsearch.node.id":"EDzxdMgoQWalZ-iGjtWMkg","Elasticsearch.node.name":"elastic","Elasticsearch.cluster.name":"elastic-cluster"}

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [May 5, 2022, 12:00pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020/2 "2022-05-05T12:00:46Z")

</div>

Some process/component in your environment is creating pipeline with SetSecurityProcessor. You need find that process/component and stop it from sending the [PutIngestPipeline](https://www.elastic.co/guide/en/elasticsearch/reference/current/put-pipeline-api.html) request.

---

<div class="post-metadata">

**Author:** ![elephant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elephant/32/103014_2.png) [@elephant](https://discuss.elastic.co/u/elephant)\
**Post date:** [May 5, 2022, 2:31pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020/3 "2022-05-05T14:31:54Z")

</div>

> [@Yang\_Wang](#):
>
> [PutIngestPipeline](https://www.elastic.co/guide/en/elasticsearch/reference/current/put-pipeline-api.html)

Stopping Metricbeat stops the warn logs. But I don't see anything related to this topic in metribeat documentation nor even source code.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2022, 2:32pm UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/304020/4 "2022-06-02T14:32:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.