# Logstash 6.2.3 Arcsight Module setup error
**URL:** https://discuss.elastic.co/t/logstash-6-2-3-arcsight-module-setup-error/133648
**Category:** Logstash
**Created:** [May 29, 2018, 9:12am UTC](https://discuss.elastic.co/t/logstash-6-2-3-arcsight-module-setup-error/133648 "2018-05-29T09:12:52Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@shaigb](https://discuss.elastic.co/u/shaigb)
#### Post date: [May 29, 2018, 9:12am UTC](https://discuss.elastic.co/t/logstash-6-2-3-arcsight-module-setup-error/133648/1 "2018-05-29T09:12:52Z")
Hi ,
I'm trying to Integrate arcsight SIEM and ELK.
I don't know why, but every version of ELK that I'm trying to deploy and install, I always ger an error in the Logstash Arcsight Module Setup when I run it from the command line.
below is the following error.
Is there a way to configure this via te config files?
Anybody managed to implement this?
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[INFO] 2018-05-28 05:14:06.308 [main] scaffold - Initializing module {:module\_name=\>"netflow", :directory=\>"/usr/share/logstash/modules/netflow/configuration"}
[INFO] 2018-05-28 05:14:06.320 [main] scaffold - Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/usr/share/logstash/modules/fb\_apache/configuration"}
[INFO] 2018-05-28 05:14:06.660 [main] scaffold - Initializing module {:module\_name=\>"arcsight", :directory=\>"/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/x-pack-6.2.4-java/modules/arcsight/configuration"}
[WARN] 2018-05-28 05:14:07.132 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO] 2018-05-28 05:14:07.438 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"6.2.4"}
[INFO] 2018-05-28 05:14:07.696 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600}
[ERROR] 2018-05-28 05:14:08.978 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] sourceloader - Could not fetch all the sources {:exception=\>LogStash::ConfigLoadingError, :message=\>"Failed to parse the module configuration: [[401] ]", :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/elasticsearch-transport-5.0.4/lib/elasticsearch/transport/transport/base.rb:202:in `__raise_transport_error'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/elasticsearch-transport-5.0.4/lib/elasticsearch/transport/transport/base.rb:319:in`perform\_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/elasticsearch-transport-5.0.4/lib/elasticsearch/transport/transport/http/manticore.rb:67:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/elasticsearch-transport-5.0.4/lib/elasticsearch/transport/client.rb:131:in`perform\_request'", "/usr/share/logstash/logstash-core/lib/logstash/elasticsearch\_client.rb:85:in `head'", "/usr/share/logstash/logstash-core/lib/logstash/elasticsearch_client.rb:55:in`can\_connect?'", "/usr/share/logstash/logstash-core/lib/logstash/elasticsearch\_client.rb:139:in `can_connect?'", "/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:76:in`block in pipeline\_configs'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:56:in`pipeline\_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source/modules.rb:16:in `pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:59:in`block in fetch'", "org/jruby/RubyArray.java:2481:in `collect'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:58:in`fetch'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:148:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in`block in initialize'"]}
[ERROR] 2018-05-28 05:14:08.981 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] agent - An exception happened when converging configuration {:exception=\>RuntimeError, :message=\>"Could not fetch the configuration, message: Failed to parse the module configuration: [[401] ]", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/agent.rb:155:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in`block in initialize'"]}
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [May 29, 2018, 9:48am UTC](https://discuss.elastic.co/t/logstash-6-2-3-arcsight-module-setup-error/133648/2 "2018-05-29T09:48:58Z")
Logstash can't connect to Elasticsearch. 401 Unauthorised error.
Check out these blog posts.
Integrating the Elastic Stack with ArcSight SIEM
[Part 1](https://www.elastic.co/blog/integrating-elasticsearch-with-arcsight-siem-part-1)
[Part 2](https://www.elastic.co/blog/integrating-elasticsearch-with-arcsight-siem-part-2)
[Part 3](https://www.elastic.co/blog/integrating-elasticsearch-with-arcsight-siem-part-3)
[Part 4](https://www.elastic.co/blog/integrating-elasticsearch-with-arcsight-siem-part-4)
[Part 5](https://www.elastic.co/blog/integrating-elasticsearch-with-arcsight-siem-part-5)
[Part 6](https://www.elastic.co/blog/integrating-elasticsearch-with-arcsight-siem-part-6)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 26, 2018, 9:49am UTC](https://discuss.elastic.co/t/logstash-6-2-3-arcsight-module-setup-error/133648/3 "2018-06-26T09:49:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.