# ElasticSearch crashed from a user query and the main superuser elastic is now not able to authenticate **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [July 22, 2022, 9:54pm UTC](https://discuss.elastic.co/t/elasticsearch-crashed-from-a-user-query-and-the-main-superuser-elastic-is-now-not-able-to-authenticate/310428 "2022-07-22T21:54:11Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![jcheeks5281](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jcheeks5281](https://discuss.elastic.co/u/jcheeks5281)\ **Post date:** [July 22, 2022, 9:54pm UTC](https://discuss.elastic.co/t/elasticsearch-crashed-from-a-user-query-and-the-main-superuser-elastic-is-now-not-able-to-authenticate/310428/1 "2022-07-22T21:54:11Z")
A query was ran from another tool that caused the whole ElasticSearch version 7.1 to lose authentication with the main user elastic. How can the elastic user be reset for the main elastic user? I already tried the password setup again but it's not able to rotate since it's been changed once. The setup underneath is xpack security. /opt/elasticsearch/bin/elasticsearch-setup-passwords interactive -u ```auto Failed to authenticate user 'elastic' against http://myhostnames:9200/_security/_authenticate?pretty Possible causes include: * The password for the 'elastic' user has already been changed on this cluster * Your elasticsearch node is running against a different keystore This tool used the keystore at /opt/elasticsearch/config/elasticsearch.keystore ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 22, 2022, 9:54pm UTC](https://discuss.elastic.co/t/elasticsearch-crashed-from-a-user-query-and-the-main-superuser-elastic-is-now-not-able-to-authenticate/310428/2 "2022-07-22T21:54:12Z")
ElasticSearch version 7.1 is [EOL](https://www.elastic.co/support/eol) and no longer supported. Please upgrade ASAP. (This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: ) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 24, 2022, 10:30pm UTC](https://discuss.elastic.co/t/elasticsearch-crashed-from-a-user-query-and-the-main-superuser-elastic-is-now-not-able-to-authenticate/310428/3 "2022-07-24T22:30:37Z")
> [@jcheeks5281](#): > > A query was ran from another tool that caused the whole Elasticsearch version 7.1 to lose authentication with the main user elastic That seems pretty odd. The first thing you should do is upgrade, 7.1 is very very old. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 25, 2022, 7:01am UTC](https://discuss.elastic.co/t/elasticsearch-crashed-from-a-user-query-and-the-main-superuser-elastic-is-now-not-able-to-authenticate/310428/5 "2022-07-25T07:01:37Z")
> [@jcheeks5281](#): > > A query was ran from another tool that caused the whole Elasticsearch version 7.1 to lose authentication with the main user elastic. Whatever the trigger was, it has probably caused some or all of your indices to be unavailable in the cluster. That could mean a node is offline, or a disk was filled, or something else. Really the first think to do is to look at your Elasticsearch logs. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 22, 2022, 7:02am UTC](https://discuss.elastic.co/t/elasticsearch-crashed-from-a-user-query-and-the-main-superuser-elastic-is-now-not-able-to-authenticate/310428/7 "2022-08-22T07:02:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.