# Got response code '401' contacting Elasticsearch

**URL:** <https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch/369890>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [October 31, 2024, 8:44pm UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch/369890 "2024-10-31T20:44:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aldosilva6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aldosilva6/32/68843_2.png) [@aldosilva6](https://discuss.elastic.co/u/aldosilva6)\
**Post date:** [October 31, 2024, 8:44pm UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch/369890/1 "2024-10-31T20:44:38Z")

</div>

I was working with Logstash, Elasticsearch and Kibana without security and everything was working, but I needed to put a basic authentication on Elasticsearch to go to production, and Logstash stoped to send messages to Elasticsearch.

Error:

```auto
Oct 31 17:31:15 vm-mcs-kafka logstash[1169]: [2024-10-31T17:31:15,429][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://10.145.2.5:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '401' contacting Elasticsearch at URL 'http://10.145.2.5:9200/'"}
Oct 31 17:31:18 vm-mcs-kafka logstash[1169]: [2024-10-31T17:31:18,270][ERROR][logstash.outputs.elasticsearch][main][8fcfb049450aaf0d9cfe6fd056986bfea576fc70664e1a4563b8f521cac8206b] Encountered a retryable error (will retry with exponential backoff) {:code=>401, :url=>"http://10.145.2.5:9200/_bulk", :content_length=>441}

```

I've configured the user and password from Elasticsearch on logstash.conf

```auto
if "kafka-process-topic" in [tags] {
        elasticsearch {
            hosts => ["http://10.145.2.5:9200"]
            index => "kafka-process-topic-%{+YYYY-MM-dd}"
	        ssl => false
            ssl_certificate_verification => false
	        user => "logstash_internal"
            password => "######"
        }
  }

```

I tried many different forms but no one worked. I tried to use elastic user and password that I use to log in on Kibana, I tried to pass without `ssl` and `ssl_certificate_verificaiton`, I tried to pass without quotes.

I know that it is not user, password or network because if I try by curl it works:

curl [http://10.145.2.5:9200/\_xpack](http://10.145.2.5:9200/_xpack) -k -u elastic:######  
curl [http://10.145.2.5:9200/\_xpack](http://10.145.2.5:9200/_xpack) -k -u logstash\_internal:#######

All the products are in the same version: 7.17.24

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 1, 2024, 5:56am UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch/369890/2 "2024-11-01T05:56:20Z")

</div>

Try with https  
`hosts => ["https://10.145.2.5:9200"]`

---

<div class="post-metadata">

**Author:** ![aldosilva6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aldosilva6/32/68843_2.png) [@aldosilva6](https://discuss.elastic.co/u/aldosilva6)\
**Post date:** [November 1, 2024, 6:06pm UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch/369890/3 "2024-11-01T18:06:40Z")

</div>

I find out the real problem thanks to your answer @Rios . Aftering I changed the logstash.conf file the log keeped showing HTTP, so I find out my problem was that the service restart was not working and it wasn't taking my file after change, so I did a few steps:

1-) Find the logstash process

```auto
ps -ef | grep logstash

```

2-) Kill the process:

```auto
sudo kill -9 <pid from prevoius command>

```

3-) Start the logstash service:

```auto
service logstash start

```

Sometimes the thread keep stuck and you can't restart by `service restart`. I also could remove some additional configurations from logstash.con

```auto
  if "kafka-process-topic" in [tags] {
        elasticsearch {
            hosts => ["http://10.145.2.5:9200"]
            index => "kafka-process-topic-%{+YYYY-MM-dd}"
	        user => "logstash_internal"
            password => "######"
        }
  }

```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 1, 2024, 6:33pm UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch/369890/4 "2024-11-01T18:33:51Z")

</div>

> [@aldosilva6](#):
>
> `ssl => false`

Ah sorry, I didn't pay attention on this param that is set to false. You have used curl -k which is not needed for the http connection.

Be aware if you do upgrade to 8.x one day, some conf options have been changed, such as `ssl` =\> true/false is `ssl_enabled` etc.