# Elasticsearch is unable to authenticate the credentials
**URL:** https://discuss.elastic.co/t/elasticsearch-is-unable-to-authenticate-the-credentials/277981
**Category:** Elasticsearch
**Created:** [July 6, 2021, 3:44pm UTC](https://discuss.elastic.co/t/elasticsearch-is-unable-to-authenticate-the-credentials/277981 "2021-07-06T15:44:36Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)
#### Post date: [July 6, 2021, 3:44pm UTC](https://discuss.elastic.co/t/elasticsearch-is-unable-to-authenticate-the-credentials/277981/1 "2021-07-06T15:44:36Z")
I had enabled authentication on my ELK stack (single node) , every thing works as expected (role,users etc). however my elasticsearch logs have logged some errors such as
```auto
[2021-07-06T15:33:59,086][INFO][o.e.x.s.a.AuthenticationService] [dev-eng05] Authentication of [kibana_system] was terminated by realm [reserved] - failed to authenticate user [kibana_system]
```
I have confirmed the credentials via curl to be correct
> ```auto
> root@dev-eng05:/etc/logstash# curl -u kibana_system 'http://172.26.205.249:9200/_xpack/security/_authenticate?pretty'
> Enter host password for user 'kibana_system':
> {
> "username" : "kibana_system",
> "roles" : [
> "kibana_system"
> ],
> "full_name" : null,
> "email" : null,
> "metadata" : {
> "_reserved" : true
> },
> "enabled" : true,
> "authentication_realm" : {
> "name" : "reserved",
> "type" : "reserved"
> },
> "lookup_realm" : {
> "name" : "reserved",
> "type" : "reserved"
> },
> "authentication_type" : "realm"
> }
> root@dev-eng05:/etc/logstash#
>
> ```
```auto
*# If your Elasticsearch is protected with basic authentication, these settings provide*
*# the username and password that the Kibana server uses to perform maintenance on the Kibana*
*# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which*
*# is proxied through the Kibana server.*
***elasticsearch.username*** *:* *"kibana_system"*
***elasticsearch.password*** *:* *"Test123"*
```
When trying to run my logstash
```auto
[2021-07-06T15:42:19,047][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://172.26.205.249:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '401' contacting Elasticsearch at URL 'http://172.26.205.249:9200/'"}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 3, 2021, 3:45pm UTC](https://discuss.elastic.co/t/elasticsearch-is-unable-to-authenticate-the-credentials/277981/2 "2021-08-03T15:45:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.