, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.6.2-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:80:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.6.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:332:in `perform_request_to_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.6.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:319:in `block in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.6.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:414:in `with_connection'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.6.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:318:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.6.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:326:in `block in head'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.6.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:341:in `exists?'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.6.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:359:in `rollover_alias_exists?'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.6.2-java/lib/logstash/outputs/elasticsearch/ilm.rb:91:in `maybe_create_rollover_alias'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.6.2-java/lib/logstash/outputs/elasticsearch/ilm.rb:10:in `setup_ilm'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.6.2-java/lib/logstash/outputs/elasticsearch/common.rb:50:in `block in setup_after_successful_connection'"]}
uelklog01d | [2020-11-26T17:17:06,333][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
uelklog01d exited with code 1
```
Any help would be appreciate.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 26, 2020, 7:18pm UTC](https://discuss.elastic.co/t/logstash-7-9-2-docker-doesnt-start/256806/2 "2020-11-26T19:18:40Z")
> [@Waxman](#):
>
> ```auto
> uelklog01d | [2020-11-26T17:17:06,138][ERROR][logstash.outputs.elasticsearch] Failed to install template. {
>
> ```
When it tries to setup ilm it sends a request to elasticsearch to determine whether the rollover index exists. That is getting a 403 status. Do the elasticsearch logs tell you anything?
---
### Author:  [@Waxman](https://discuss.elastic.co/u/Waxman)
#### Post date: [November 27, 2020, 8:05am UTC](https://discuss.elastic.co/t/logstash-7-9-2-docker-doesnt-start/256806/3 "2020-11-27T08:05:05Z")
I found only this:
```auto
stacktrace": ["org.elasticsearch.ElasticsearchSecurityException: action [indices:admin/get] is unauthorized for user [logstash_system],
```
This is strange cause user logstash\_system has got privileges to the cluster:
```auto
curl --cacert /pwd/certificates/ca/ca.crt -ku logstash_system https://xxx:9200/_cluster/health?pretty
Enter host password for user logstash_system:
{
"cluster_name" : "es-cluster",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 4,
"number_of_data_nodes" : 3,
"active_primary_shards" : 60,
"active_shards" : 120,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
```
---
### Author:  [@Waxman](https://discuss.elastic.co/u/Waxman)
#### Post date: [November 27, 2020, 9:42am UTC](https://discuss.elastic.co/t/logstash-7-9-2-docker-doesnt-start/256806/4 "2020-11-27T09:42:21Z")
The funny thing: when I change the user from logstash\_system to elastic then everything went ok. What' s the casue? If there is a need to add some privileges to the logstash\_system ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 27, 2020, 1:47pm UTC](https://discuss.elastic.co/t/logstash-7-9-2-docker-doesnt-start/256806/5 "2020-11-27T13:47:19Z")
Not sure, that's really an elasticsearch question, not a logstash question.
---
### Author:  [@Waxman](https://discuss.elastic.co/u/Waxman)
#### Post date: [November 27, 2020, 2:10pm UTC](https://discuss.elastic.co/t/logstash-7-9-2-docker-doesnt-start/256806/6 "2020-11-27T14:10:23Z")
I will try this advice:[https://www.elastic.co/guide/en/logstash/current/ls-security.html](https://www.elastic.co/guide/en/logstash/current/ls-security.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 25, 2020, 2:10pm UTC](https://discuss.elastic.co/t/logstash-7-9-2-docker-doesnt-start/256806/7 "2020-12-25T14:10:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.