Error with packetbeat after shield installation?

while im starting the packetbeat service as /etc/init.d/packetbeat start
Its giving me error as:

output.go:64: ERR  Fail to set _ttl mapping: ES returned an error: 401 Unauthorized
publish.go:232: ERR  Fail to initialize elasticsearch plugin as output: ES returned an error: 401 Unauthorized
main.go:150: CRIT ES returned an error: 401 Unauthorized!

I have created a role by using shield.if it is the problem how to start packetbeat? Help me

If you can provide your config, both Shield and Packetbeat, it'd be helpful :smile:
Also try enabling Shield debug mode - shield.authc: DEBUG in logging.yml.

This is my packetbeat.yml

What about Shield?

Also, something like gist/pastebin/etc is easier for people to use, rather than downloading an entire file :slight_smile: