# Got response code '401' contacting Elasticsearch at URL 7.4
**URL:** https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch-at-url-7-4/205850
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [October 30, 2019, 12:17pm UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch-at-url-7-4/205850 "2019-10-30T12:17:50Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Ivan\_D](https://discuss.elastic.co/u/Ivan_D)
#### Post date: [October 30, 2019, 12:17pm UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch-at-url-7-4/205850/1 "2019-10-30T12:17:50Z")
Hi, i have enabled xpack and facing in issues with logstash connection
`elasticsearch.yml`
```auto
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.audit.enabled: true
```
`output.conf` in logstash
```auto
output {
if [type] == "elblogs" {
elasticsearch {
hosts => ["someip:9200"]
index => "elb-%{+YYYY.MM.dd}"
user => "logstash_admin_user"
password => "logstash_admin_user"
}
}
}
```
```auto
[2019-10-30T12:05:54,093][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://:9200/'"}
[2019-10-30T12:05:54,105][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://:9200/'"}
[2019-10-30T12:05:59,097][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://:9200/'"}
[2019-10-30T12:05:59,111][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://:9200/'"}
```
i can establish connection via this user to remote ES
```auto
curl -u logstash_admin_user 'http://:9200/_xpack/security/_authenticate?pretty'
Enter host password for user 'logstash_admin_user':
{
"username" : "logstash_admin_user",
"roles" : [
"superuser"
],
"full_name" : "",
"email" : "",
"metadata" : { },
"enabled" : true,
"authentication_realm" : {
"name" : "default_native",
"type" : "native"
},
"lookup_realm" : {
"name" : "default_native",
"type" : "native"
}
}
```
---
### Author:  [@Bhanu\_Pratap\_Singh](https://discuss.elastic.co/u/Bhanu_Pratap_Singh)
#### Post date: [November 2, 2019, 7:45pm UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch-at-url-7-4/205850/2 "2019-11-02T19:45:56Z")
Hey Ivan,
You can try the below mentioned configuration, it worked for me.
##############################################################################
#
# Logstash config file that ingests blog posts from a csv file.
# **elastic** user is **superuser**
#cluster is XPACK enabled #
##############################################################################
input {
file {
path =\> "C:/Users/PATH\_TO\_YOUR\_CSV/blogs.csv"
start\_position =\> "beginning"
sincedb\_path =\> "/dev/null"
}
}
filter {
dissect {
mapping =\> {
"message" =\> "%{title};%{seo\_title};%{url};%{author};%{date};%{category};%{locales};%{content}"
}
}
date {
match =\> ["date", "MMMM dd, yyyy"]
target =\> "publish\_date"
remove\_field =\> ["date"]
}
mutate {
remove\_field =\> ["@version", "path", "host", "message", "tags", "@timestamp"]
}
}
output {
elasticsearch {
hosts =\> "[http://localhost:9200](http://localhost:9200)"
user =\> "elastic"
password =\> "elastic"
index =\> "blogs"
retry\_on\_conflict =\> 0
}
stdout { codec =\> "dots"}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 30, 2019, 7:49pm UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch-at-url-7-4/205850/3 "2019-11-30T19:49:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.