# Kibana Logs Authentication Failure

**URL:** <https://discuss.elastic.co/t/kibana-logs-authentication-failure/376385>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [March 25, 2025, 3:02pm UTC](https://discuss.elastic.co/t/kibana-logs-authentication-failure/376385 "2025-03-25T15:02:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Echo\_01](https://avatars.discourse-cdn.com/v4/letter/e/a698b9/32.png) [@Echo\_01](https://discuss.elastic.co/u/Echo_01)\
**Post date:** [March 25, 2025, 3:02pm UTC](https://discuss.elastic.co/t/kibana-logs-authentication-failure/376385/1 "2025-03-25T15:02:11Z")

</div>

Kibana is generating failure logs like the following:

```auto
[2025-03-25T15:49:06.652+01:00][INFO][plugins.security.authentication] Authentication attempt failed: {"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/_security/_authenticate]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/_security/_authenticate]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}

```

I cannot find an 'elastic' user defined anywhere in the Kibana configuration.

Can anyone point me in the direction of the configuration for [plugins.security.authentication] ?