# Error 403 when log camin on logstah **URL:** \ **Category:** Logstash\ **Created:** [July 8, 2017, 11:18am UTC](https://discuss.elastic.co/t/error-403-when-log-camin-on-logstah/92359 "2017-07-08T11:18:19Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![egalizia](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@egalizia](https://discuss.elastic.co/u/egalizia)\ **Post date:** [July 8, 2017, 11:18am UTC](https://discuss.elastic.co/t/error-403-when-log-camin-on-logstah/92359/1 "2017-07-08T11:18:19Z")
HI I install and configure ELK and all work I install the x-pack needed to get authentication to see log and got same problem on logstash when log start caming from nxlog I got this error [2017-07-08T13:09:13,837][ERROR][logstash.outputs.elasticsearch] Got a bad response code from server, but this code is not considered retryable. Request will be dropped {:code=\>403, :response\_body=\>"{"error":{"root\_cause":[{"type":"security\_exception","reason":"action [indices:data/write/bulk] is unauthorized for user [logstash\_system]"}],"type":"security\_exception","reason":"action [indices:data/write/bulk] is unauthorized for user [logstash\_system]"},"status":403}"} think same problem of authentication in logstash i add xpack.monitoring.elasticsearch.url: [http://ip:9200](http://ip:9200) xpack.monitoring.elasticsearch.username: logstash\_system xpack.monitoring.elasticsearch.password: pass.... and config output { elasticsearch { ``` hosts => ["ip"] user => logstash_system password => pass... ``` } stdout { codec =\> rubydebug } } ---
**Author:** ![egalizia](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@egalizia](https://discuss.elastic.co/u/egalizia)\ **Post date:** [July 10, 2017, 7:25am UTC](https://discuss.elastic.co/t/error-403-when-log-camin-on-logstah/92359/2 "2017-07-10T07:25:49Z")
without x-pack all work fine when I install x-pack and configure all like manual ony logstahs dnt work .... kibana is ok ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 10, 2017, 7:40am UTC](https://discuss.elastic.co/t/error-403-when-log-camin-on-logstah/92359/3 "2017-07-10T07:40:18Z")
Have you followed the instructions in the [docs](https://www.elastic.co/guide/en/x-pack/current/logstash.html)? ---
**Author:** ![egalizia](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@egalizia](https://discuss.elastic.co/u/egalizia)\ **Post date:** [July 10, 2017, 11:42am UTC](https://discuss.elastic.co/t/error-403-when-log-camin-on-logstah/92359/4 "2017-07-10T11:42:22Z")
if use elastic user on config of logstash all work fine thinnk same problem on role of logstash\_system default user ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 10, 2017, 11:57am UTC](https://discuss.elastic.co/t/error-403-when-log-camin-on-logstah/92359/5 "2017-07-10T11:57:20Z")
If you look in [the docs](https://www.elastic.co/guide/en/x-pack/5.5/setting-up-authentication.html#built-in-users) the `logstash_system` is for writing monitoring data. Have you tried creating a `logstash_internal` user with a `logstash_writer` role as outlined in the docs I linked to previously? ---
**Author:** ![egalizia](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@egalizia](https://discuss.elastic.co/u/egalizia)\ **Post date:** [July 10, 2017, 1:55pm UTC](https://discuss.elastic.co/t/error-403-when-log-camin-on-logstah/92359/6 "2017-07-10T13:55:14Z")
Now @ home if I can I try make a fast wirtual machina here and try I tell you if I solve tks ---
**Author:** ![egalizia](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@egalizia](https://discuss.elastic.co/u/egalizia)\ **Post date:** [July 11, 2017, 9:11am UTC](https://discuss.elastic.co/t/error-403-when-log-camin-on-logstah/92359/7 "2017-07-11T09:11:53Z")
tks mate follow guide and work tks so much ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 8, 2017, 9:12am UTC](https://discuss.elastic.co/t/error-403-when-log-camin-on-logstah/92359/8 "2017-08-08T09:12:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.