Error with packetbeat after shield installation?

Elastic Stack Beats
1

while im starting the packetbeat service as /etc/init.d/packetbeat start
Its giving me error as:

output.go:64: ERR  Fail to set _ttl mapping: ES returned an error: 401 Unauthorized
publish.go:232: ERR  Fail to initialize elasticsearch plugin as output: ES returned an error: 401 Unauthorized
main.go:150: CRIT ES returned an error: 401 Unauthorized
   ...fail!

I have created a role by using shield.if it is the problem how to start packetbeat? Help me

2

If you can provide your config, both Shield and Packetbeat, it'd be helpful :smile:
Also try enabling Shield debug mode - shield.authc: DEBUG in logging.yml.

3

This is my packetbeat.yml

4

What about Shield?

Also, something like gist/pastebin/etc is easier for people to use, rather than downloading an entire file :slight_smile: