if you install xpack, the security feature is enabled by default - thus you need to authenticate. If you dont want to do that, you can set xpack.security.enabled: false and you are good to go.
When you include the username and password in the URL, it is the client's job to process it and turn it into a Basic authentication header in the HTTP request.
That is, the elastic:changeme part of your URL never gets sent directly to Elasticsearch, but need to be specially handled within your 3rd party application.
If you paste that URL into curl you should find that it works fine.
e.g. I just ran curl --verbose 'http://elastic:changeme@localhost:9200/' and got the correct result, because curl is handling the embedded parameters.
My best guess is that your 3rd party application does not handling embedded username+password in URLs. You will need to talk to the vendor of that application about that.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.