# ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(https://\)): 401 Unauthorized **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 13, 2020, 12:04pm UTC](https://discuss.elastic.co/t/error-pipeline-output-go-100-failed-to-connect-to-backoff-elasticsearch-https-es-url-401-unauthorized/227772 "2020-04-13T12:04:56Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![\_kyllr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/_kyllr/32/27610_2.png) [@\_kyllr](https://discuss.elastic.co/u/_kyllr)\ **Post date:** [April 13, 2020, 12:04pm UTC](https://discuss.elastic.co/t/error-pipeline-output-go-100-failed-to-connect-to-backoff-elasticsearch-https-es-url-401-unauthorized/227772/1 "2020-04-13T12:04:56Z")
Hello, AWS Elasticsearch Version: 7.1 aws-es-proxy-0.9-windows-amd64.exe Kibana OSS 7.1.1 Filebeat OSS 7.1.1 This is a production issue on our windows server, we suddenly got this error from filebeat logs: > 2020-04-13T06:41:59.305-0400 ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(https://\)): 401 Unauthorized: This causing our Elasticsearch not collecting logs. _config/kibana.yml_ > server.port: 5609 > server.host: "" > server.basePath: "/7.1/kibana" > elasticsearch.url: "[http://127.0.0.1:9230/](http://127.0.0.1:9230/)" > elasticsearch.ssl.verificationMode: none _config/filebeat.yml_ > username: "" > password: "" > setup.ilm.enabled: false Other filebeat config wasn't mention here. Could someone please help me find out and understand the reason of the issue. ---
**Author:** ![\_kyllr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/_kyllr/32/27610_2.png) [@\_kyllr](https://discuss.elastic.co/u/_kyllr)\ **Post date:** [April 14, 2020, 1:02am UTC](https://discuss.elastic.co/t/error-pipeline-output-go-100-failed-to-connect-to-backoff-elasticsearch-https-es-url-401-unauthorized/227772/2 "2020-04-14T01:02:19Z")
Please someone can help me in this issue. ---
**Author:** ![\_kyllr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/_kyllr/32/27610_2.png) [@\_kyllr](https://discuss.elastic.co/u/_kyllr)\ **Post date:** [April 14, 2020, 6:20am UTC](https://discuss.elastic.co/t/error-pipeline-output-go-100-failed-to-connect-to-backoff-elasticsearch-https-es-url-401-unauthorized/227772/3 "2020-04-14T06:20:16Z")
Please help me on this. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 14, 2020, 7:15am UTC](https://discuss.elastic.co/t/error-pipeline-output-go-100-failed-to-connect-to-backoff-elasticsearch-https-es-url-401-unauthorized/227772/4 "2020-04-14T07:15:51Z")
It seems like you are using a non-standard proxy, so I am not sure how much help you will be able to get here. I would recommend contacting the creator of the proxy. ---
**Author:** ![\_kyllr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/_kyllr/32/27610_2.png) [@\_kyllr](https://discuss.elastic.co/u/_kyllr)\ **Post date:** [April 14, 2020, 10:30am UTC](https://discuss.elastic.co/t/error-pipeline-output-go-100-failed-to-connect-to-backoff-elasticsearch-https-es-url-401-unauthorized/227772/5 "2020-04-14T10:30:20Z")
We tried to reinstall the filebeat service, and it starts collecting logs again. Though we may lose some of our data by doing so. Here's what we can see now in filebeat logs: > ``` > |2020-04-14T04:45:32.342-0400|INFO|log/harvester.go:254|Harvester started for file: d:\logs\Audit.txt.0| > |2020-04-14T04:45:32.342-0400|INFO|log/harvester.go:254|Harvester started for file: d:\apps\web\oauth\logs\OauthAudit.txt.0| > |2020-04-14T04:45:32.372-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'm' in string escape code| > |2020-04-14T04:45:32.377-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'g' in string escape code| > |2020-04-14T04:45:32.378-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'w' in string escape code| > |2020-04-14T04:45:32.392-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'w' in string escape code| > |2020-04-14T04:45:32.397-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'a' in string escape code| > |2020-04-14T04:45:32.397-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'j' in string escape code| > |2020-04-14T04:45:32.398-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'c' in string escape code| > |2020-04-14T04:45:32.399-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 's' in string escape code| > |2020-04-14T04:45:32.400-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'j' in string escape code| > |2020-04-14T04:45:32.400-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'e' in string escape code| > |2020-04-14T04:45:32.400-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'j' in string escape code| > |2020-04-14T04:45:32.403-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'p' in string escape code| > |2020-04-14T04:45:32.405-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'j' in string escape code| > |2020-04-14T04:45:32.410-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'a' in string escape code| > |2020-04-14T04:45:32.416-0400|ERROR|readjson/json.go:52|Error decoding JSON: invalid character 'm' in string escape code| > > ``` Any idea with the error? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 12, 2020, 10:30am UTC](https://discuss.elastic.co/t/error-pipeline-output-go-100-failed-to-connect-to-backoff-elasticsearch-https-es-url-401-unauthorized/227772/6 "2020-05-12T10:30:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.