Looking through the elasticsearch logs, after a restart of the service, I see this:
[2022-10-26T06:19:39,233][INFO ][o.e.x.s.a.RealmsAuthenticator] [ip-10-10-5-195.XXXX.com] Authentication of [kibana] was terminated by realm [reserved] - failed to authenticate user [kibana]
I look through kibana.yml and the elasticsearch.username is kibana_system - so I'm not sure where the kibana user is coming from - but this is an INFO level log entry. Not sure what to make of this.