# Failed to connect to backoff **URL:** \ **Category:** Beats\ **Tags:** elastic-stack-security, metricbeat\ **Created:** [September 22, 2021, 6:13pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff/284922 "2021-09-22T18:13:43Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![rachelyang](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Post date:** [September 22, 2021, 6:13pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff/284922/1 "2021-09-22T18:13:43Z")
I set up minimum and basic TLS security for the Elasticsearch cluster. The metricbeat cannot push data to the Elasticsearch node. Here is the error in log file. metricbeat[26335]: 2021-09-22T18:08:39.471Z ERROR [publisher\_pipeline\_output] pipeline/output.go:154 Failed to connect to backoff(Elasticsearch([http://localhost:9200](http://localhost:9200))): 401 Unauthorized: {"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security\_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401} How do I set up communication between metricbeat and secured Elasticsearch? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [September 23, 2021, 4:45am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff/284922/2 "2021-09-23T04:45:46Z")
> **[Secure Metricbeat | Metricbeat Reference \[7.15\] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/7.15/securing-metricbeat.html)** ---
**Author:** ![rachelyang](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Post date:** [September 23, 2021, 2:45pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff/284922/3 "2021-09-23T14:45:32Z")
Hi Tim, Thanks for your help. I set up api key to grant access for Metricbeat. Here is my Post: curl -X POST "localhost:9200/\_security/api\_key?pretty" -H 'Content-Type: application/json' -d' { "name": "metricbeat\_host001", "expiration": "10y", "role\_descriptors": { "metricbeat\_writer": { "cluster": ["all"], "index": [ { "names": ["metricbeat-_"], "privileges": ["view\_index\_metadata", "create\_doc"] } ] }, "metricbeat\_monitoring": { "cluster": ["monitor"], "index": [ { "names": [".monitoring-beats-_"], "privileges": ["create\_index", "create"] } ] }, "metricbeat\_setup": { "cluster": ["all"], "index": [ { "names": ["metricbeat-\*"], "privileges": ["all"] } ] } } } ' I got an error in the reply. { "error" : { "root\_cause" : [ { "type" : "security\_exception", "reason" : "missing authentication credentials for REST request [/\_security/api\_key?pretty]", "header" : { "WWW-Authenticate" : "Basic realm="security" charset="UTF-8"" } } ], "type" : "security\_exception", "reason" : "missing authentication credentials for REST request [/\_security/api\_key?pretty]", "header" : { "WWW-Authenticate" : "Basic realm="security" charset="UTF-8"" } }, "status" : 401 } What credential do I miss? ---
**Author:** ![rachelyang](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Post date:** [September 23, 2021, 3:14pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff/284922/4 "2021-09-23T15:14:45Z")
I added username:password in the post curl: curl --user beats\_system:YUXmRQJ2rflzBMUyXIgu -X POST "localhost:9200/\_security/api\_key?pretty" -H 'Content-Type: application/json' -d'{ "name": "metricbeat\_host001", "role\_descriptors": { "metricbeat\_writer": { "cluster": ["all"], "index": [ { "names": ["metricbeat-_"], "privileges": ["view\_index\_metadata", "create\_doc"] } ] }, "metricbeat\_monitoring": { "cluster": ["monitor"], "index": [ { "names": [".monitoring-beats-_"], "privileges": ["create\_index", "create"] } ] }, "metricbeat\_setup": { "cluster": ["all"], "index": [ { "names": ["metricbeat-\*"], "privileges": ["all"] } ] } } } ' The error message: { "error" : { "root\_cause" : [ { "type" : "security\_exception", "reason" : "action [cluster:admin/xpack/security/api\_key/create] is unauthorized for user [beats\_system] with roles [beats\_system], this action is granted by the cluster privileges [manage\_own\_api\_key,manage\_api\_key,manage\_security,all]" } ], "type" : "security\_exception", "reason" : "action [cluster:admin/xpack/security/api\_key/create] is unauthorized for user [beats\_system] with roles [beats\_system], this action is granted by the cluster privileges [manage\_own\_api\_key,manage\_api\_key,manage\_security,all]" }, "status" : 403 } Which role can create api key? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [September 24, 2021, 2:20am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff/284922/5 "2021-09-24T02:20:02Z")
You can use a superuser like `elastic` to create an API Key, however for a production environment we would typically recommend you create a dedicated user to manage API Keys for your beats. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 22, 2021, 2:20am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff/284922/6 "2021-10-22T02:20:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.