### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [July 4, 2017, 9:00am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/1 "2017-07-04T09:00:08Z")
[2017-07-04T14:24:02,247][ERROR][logstash.outputs.elasticsearch] Got a bad response code from server, but this code is not considered retryable. Request will be dropped {:code=\>401, :response\_body=\>"{"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication token for REST request [/\_bulk]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security\_exception","reason":"missing authentication token for REST request [/\_bulk]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}"}
[2017-07-04T14:24:04,504][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://xx.xx.x.xx:9200/](http://xx.xx.x.xx:9200/), :path=\>"/"}
[2017-07-04T14:24:04,509][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\, :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at URL '[http://xx.xx.x.xx:9200/](http://xx.xx.x.xx:9200/)'"}
---
### Author:  [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)
#### Post date: [July 4, 2017, 9:05am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/2 "2017-07-04T09:05:20Z")
> [@DharaniKumar](#):
>
> missing authentication token for REST request [/\_bulk]","header":{"WWW-Authenticate"
Read above and sort it out
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [July 4, 2017, 9:09am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/3 "2017-07-04T09:09:09Z")
where to sort this out... in kibana console???
before installing x-pack in my ELK stack im not getting any issues like this... Im getting this error log after installing x-pack...😕
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 4, 2017, 9:23am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/4 "2017-07-04T09:23:55Z")
Have you configured Logstash to authenticate to ES?
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [July 4, 2017, 9:25am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/5 "2017-07-04T09:25:35Z")
Yes i did.
xpack.monitoring.elasticsearch.url: ["[http://xx.xx.xx.xx:9200](http://xx.xx.xx.xx:9200)"]
xpack.monitoring.elasticsearch.username: "logstash\_system"
xpack.monitoring.elasticsearch.password: "password"
xpack.monitoring.enabled: true
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [July 4, 2017, 9:27am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/6 "2017-07-04T09:27:47Z")
when ever im installing x-pack im facing this issue... and filebeat also not working properly after x-pack installation...
---
### Author:  [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)
#### Post date: [July 4, 2017, 9:28am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/7 "2017-07-04T09:28:38Z")
The configuration is not correct, as its not able to authenticate.
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [July 4, 2017, 9:42am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/8 "2017-07-04T09:42:45Z")
Now i uninstalled x-pack and im not getting any issues with filebeat and logstash
---
### Author:  [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)
#### Post date: [July 4, 2017, 9:58am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/9 "2017-07-04T09:58:36Z")
See you are doing something wrong while configuring X-PACK did you follow the official tutorials ?
If you can than please share the config files with us so that we can help you better.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 4, 2017, 11:27am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/10 "2017-07-04T11:27:25Z")
> Yes i did.
> xpack.monitoring.elasticsearch.url: ["[http://xx.xx.xx.xx:9200](http://xx.xx.xx.xx:9200)"]
> xpack.monitoring.elasticsearch.username: "logstash\_system"
> xpack.monitoring.elasticsearch.password: "password"
> xpack.monitoring.enabled: true
That covers the monitoring but it's the elasticsearch output plugin that's complaining. Make sure you've configured authentication there as well.
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [July 4, 2017, 11:29am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/11 "2017-07-04T11:29:59Z")
This is what i've in my elasticsearch output plugin config file.
output {
stdout { codec =\> rubydebug }
elasticsearch {
hosts =\> ["XX.XX.XX.XX:9200"]
sniffing =\> false
manage\_template =\> false
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
}
---
### Author:  [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)
#### Post date: [July 4, 2017, 11:32am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/12 "2017-07-04T11:32:54Z")
ah no i am sorry for the confusion .. I need to see what you have done for authentication in elasticsearch as Magnus Bäck asked above ..
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 4, 2017, 11:33am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/13 "2017-07-04T11:33:14Z")
> This is what i've in my elasticsearch output plugin config file.
Right, and no username and password options are set. See the elasticsearch output documentation for more on how to configure authentication.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 1, 2017, 11:33am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738/14 "2017-08-01T11:33:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.