# Help with Logstash security features **URL:** \ **Category:** Logstash\ **Created:** [May 30, 2019, 7:03pm UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597 "2019-05-30T19:03:29Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Mrcow](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Post date:** [May 30, 2019, 7:03pm UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/1 "2019-05-30T19:03:29Z")
I just enabled on my elasticsearch 7.1 the security to login with user and passwords, but logstash stop working, im getting this error [2019-05-30T12:58:41,053][ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=\>403, :url=\>"[http://10.11.7.20:9200/\_bulk](http://10.11.7.20:9200/_bulk)"} [2019-05-30T12:58:41,055][ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=\>403, :url=\>"[http://10.11.7.20:9200/\_bulk](http://10.11.7.20:9200/_bulk)"} [2019-05-30T12:58:41,058][ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=\>403, :url=\>"[http://10.11.7.20:9200/\_bulk](http://10.11.7.20:9200/_bulk)"} [2019-05-30T12:58:41,055][ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=\>403, :url=\>"[http://10.11.7.20:9200/\_bulk](http://10.11.7.20:9200/_bulk)"} my /etc/logstash/conf.d/syslog-input.conf file is this #Input by ports input { syslog { port =\> 5140 type =\> "network" } syslog { port =\> 5141 type =\> "fail2ban" } syslog { port =\> 5142 type =\> "quagga" } } #Output to logstash\_systemsearch output { elasticsearch { hosts =\> ["10.11.7.20:9200"] user =\> "logstash\_system" password =\> "Kz8twlWy9i3NWBZOYR1T" } } #Filters filter { if [type] == "enswitch" { user =\> "logstash\_system" password =\> "Kz8twlWy9i3NWBZOYR1T" grok { patterns\_dir =\> ["/etc/logstash/patterns"] match =\> ["message", "%{ENSWITCH1}"] overwrite =\> ["message"] } } } what can i do to make logstash to work again? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 30, 2019, 9:42pm UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/2 "2019-05-30T21:42:42Z")
Please format your code/logs/config using the `` button, or markdown style back ticks. It helps to make things easy to read which helps us help you 🙂 HTTP 403 means the details you are using are not valid, can you try connecting to Elasticsearch using curl and those details? ---
**Author:** ![Mrcow](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Post date:** [May 30, 2019, 10:10pm UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/4 "2019-05-30T22:10:11Z")
``` Yes, as you can see in the next screenshot if i use curl with this credentials i got a reply. ``` ![reply](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2ead54bb6570f2f2a484a127c3ae6b5aff9875a3.png) the credentials are valid ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 30, 2019, 10:11pm UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/5 "2019-05-30T22:11:30Z")
Please don't post pictures of text, they are difficult to read and some people may not be even able to see them. ---
**Author:** ![Mrcow](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Post date:** [May 30, 2019, 10:24pm UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/6 "2019-05-30T22:24:11Z")
curl -u logstash\_system:Kz8twlWy9i3NWBZOYR1T [http://10.11.7.20:9200/\_cluster/health](http://10.11.7.20:9200/_cluster/health) {"cluster\_name":"ttco-elk","status":"yellow","timed\_out":false,"number\_of\_nodes":1,"number\_of\_data\_nodes":1,"active\_primary\_shards":19,"active\_shards":19,"relocating\_shards":0,"initializing\_shards":0,"unassigned\_shards":1,"delayed\_unassigned\_shards":0,"number\_of\_pending\_tasks":0,"number\_of\_in\_flight\_fetch":0,"task\_max\_waiting\_in\_queue\_millis":0,"active\_shards\_percent\_as\_number":95.0}`Preformatted text` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 30, 2019, 10:26pm UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/7 "2019-05-30T22:26:50Z")
> [@Mrcow](#): > > logstash\_system:Kz8twlWy9i3NWBZOYR1T That doesn't match what is in your config though? ---
**Author:** ![Mrcow](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Post date:** [May 30, 2019, 10:28pm UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/8 "2019-05-30T22:28:29Z")
> [@warkolm](#): > > ? This is my /etc/logstash/logstash.yml config file ``` path.data: /var/lib/logstash path.logs: /var/log/logstash ``` ---
**Author:** ![Mrcow](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Post date:** [May 30, 2019, 10:30pm UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/9 "2019-05-30T22:30:41Z")
and the conf file of logstash is like the first post #Output to logstash\_systemsearch output { elasticsearch { hosts =\> ["10.11.7.20:9200"] user =\> "logstash\_system" password =\> "Kz8twlWy9i3NWBZOYR1T" } } ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 30, 2019, 10:32pm UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/10 "2019-05-30T22:32:12Z")
> [@Mrcow](#): > > and the conf file of logstash is like the first post Right, but that does not match the details you use in your curl. The password is entirely different. ---
**Author:** ![Mrcow](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Post date:** [May 30, 2019, 10:34pm UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/11 "2019-05-30T22:34:51Z")
i change the password in the first post only as an example i am using the right password, of course my password is not "password" ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 31, 2019, 12:20am UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/12 "2019-05-31T00:20:35Z")
Given that you are getting a 403 response code, which suggests an authentication or authorization error, being consistent in the obfuscation of your authentication data would help a lot. For sure you should obfuscate/redact it (in both this thread and the other one) but please try to be consistent, so that we know that you know when data is consistent. ---
**Author:** ![Mrcow](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Post date:** [May 31, 2019, 12:41am UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/13 "2019-05-31T00:41:42Z")
Ok i just edited the thread to be consistent, i reviewed all the config and i cant find the error on my config. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 28, 2019, 12:41am UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597/14 "2019-06-28T00:41:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.