# Error adding the marvel template after Shield installed
**URL:** https://discuss.elastic.co/t/error-adding-the-marvel-template-after-shield-installed/29608
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [September 18, 2015, 11:20pm UTC](https://discuss.elastic.co/t/error-adding-the-marvel-template-after-shield-installed/29608 "2015-09-18T23:20:40Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@mingho](https://discuss.elastic.co/u/mingho)
#### Post date: [September 18, 2015, 11:20pm UTC](https://discuss.elastic.co/t/error-adding-the-marvel-template-after-shield-installed/29608/1 "2015-09-18T23:20:40Z")
I have a one node Elasticsearch (1.7.1) cluster setting up with Marvel and Kibana and everything working OK. Then I followed the Shield (1.3.2) online doc to install the product, created an admin user, marvel\_agent and marvel\_user. But I got the following error when I restart ES:
error adding the marvel template to [x.x.x.x:8200] response code [401 Unauthorized]. content: [{"error":"AuthenticationException[missing authentication token for REST request [/\_template/marvel]]","status":401}]
could not connect to any configured elasticsearch instances: [x.x.x.x:8200]
After I login to Marvel UI as admin, I am not able to see any index in the Overview page. What's wrong?
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [September 21, 2015, 10:22am UTC](https://discuss.elastic.co/t/error-adding-the-marvel-template-after-shield-installed/29608/2 "2015-09-21T10:22:38Z")
I think you may need to provide credentials for the Marvel exporter and the user querying the marvel indices as described in [using marvel with shield](https://www.elastic.co/guide/en/shield/current/marvel.html).
---
### Author:  [@mingho](https://discuss.elastic.co/u/mingho)
#### Post date: [September 21, 2015, 5:21pm UTC](https://discuss.elastic.co/t/error-adding-the-marvel-template-after-shield-installed/29608/3 "2015-09-21T17:21:20Z")
Thanks for the reply, Jay. If you are referring the following credentials, I already confirmed that these are the default setting in the roles.yml right after I installed the Shield. All I did was to create the user marvel\_agent and marvel\_user after the install and restart ES according to the install doc. But it didn't work. If you are referring other credentials than this. please be more specific, may be I am missing something. Appreciate your help - Ming
# on the marvel indices
marvel\_user:
cluster: cluster:monitor/nodes/info, cluster:admin/plugin/license/get
indices:
'.marvel-\*': all
# Marvel Agent users
marvel\_agent:
cluster: indices:admin/template/get, indices:admin/template/put
indices:
'.marvel-\*': indices:data/write/bulk, create\_index
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [September 21, 2015, 6:10pm UTC](https://discuss.elastic.co/t/error-adding-the-marvel-template-after-shield-installed/29608/4 "2015-09-21T18:10:54Z")
Hi Ming,
Sorry I wasn't more specific; in your elasticsearch.yml file did you specify the `marvel.agent.exporter.es.hosts` setting with a user that has the `marvel_agent` role? If not, you will need to do that so that the exporter can index into the cluster.
Jay
---
### Author:  [@mingho](https://discuss.elastic.co/u/mingho)
#### Post date: [September 21, 2015, 8:15pm UTC](https://discuss.elastic.co/t/error-adding-the-marvel-template-after-shield-installed/29608/5 "2015-09-21T20:15:33Z")
Hi Jay,
I didn't do that change. When I read that section, somehow I got caught in the langue that it is only for configuring HTTPS. Once I make the change I am able to see all the indices. But one more question, the password of that user is in plain text in the elasticsearch.yml. which is a security concern. How to encrypt the password in the yml file, or I didn't do it correctly?
Thanks.
Ming
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [September 22, 2015, 11:28am UTC](https://discuss.elastic.co/t/error-adding-the-marvel-template-after-shield-installed/29608/6 "2015-09-22T11:28:03Z")
Hi Ming,
You have done it correctly. The password is in plaintext and that is a limitation that currently exists. We're looking at ways to provide better security for this, but there are some issues. If you have an encrypted value, then a key is needed to decrypt the value, and if the key is right next to the encrypted data then there really is not much added security.
One option, could be to use the elasticsearch prompt support, and start elasticsearch in the foreground. This will require you to enter the value for the `marvel.agent.exporter.es.hosts` when you start elasticsearch. This way your passwords are not stored in the elasticsearch.yml file. More information can be found at [https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration.html#styles](https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration.html#styles) (look for ${prompt.text} and ${prompt.secret}).
Jay
---
### Author:  [@mingho](https://discuss.elastic.co/u/mingho)
#### Post date: [September 22, 2015, 11:33pm UTC](https://discuss.elastic.co/t/error-adding-the-marvel-template-after-shield-installed/29608/7 "2015-09-22T23:33:20Z")
Hi Jay,
Thanks for the reply. While the suggestion is a work around to the plain text, we then can't practically start ES automatically, e.g. after a server reboot. So I will just wait for the enhancement on this issue.
Thanks.
Ming
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/error-adding-the-marvel-template-after-shield-installed/29608/8 "2017-07-06T13:48:20Z")