# Logstash 8.11 reports error 403

**URL:** <https://discuss.elastic.co/t/logstash-8-11-reports-error-403/352224>\
**Category:** Logstash\
**Created:** [January 31, 2024, 7:16pm UTC](https://discuss.elastic.co/t/logstash-8-11-reports-error-403/352224 "2024-01-31T19:16:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![andrew3](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@andrew3](https://discuss.elastic.co/u/andrew3)\
**Post date:** [January 31, 2024, 7:16pm UTC](https://discuss.elastic.co/t/logstash-8-11-reports-error-403/352224/1 "2024-01-31T19:16:56Z")

</div>

I am trying to connect logstash to elasticsearch. Both are on my local machine. I am using https.

Logstash reports error 403. Viz:

`

> {:code=\>403, :url=\>"[https://localhost:9200/\_bulk?filter\_path=errors,items.\*.error,items.\*.status](https://localhost:9200/_bulk?filter_path=errors,items.*.error,items.*.status)", :content\_length=\>2080, :body=\>"{"error":{"root\_cause":[{"type":"security\_exception","reason":"action [indices:data/write/bulk] is unauthorized for user [logstash\_system] with effective roles [logstash\_system], this action is granted by the index privileges [create\_doc,create,delete,index,write,all]"}]

`

```auto
Any help appreciated! Thks. (edited)
```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 31, 2024, 8:40pm UTC](https://discuss.elastic.co/t/logstash-8-11-reports-error-403/352224/2 "2024-01-31T20:40:00Z")

</div>

The user logstash\_system doesn't have rights on your index or you haven't set password in output elasticsearch.

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [January 31, 2024, 8:58pm UTC](https://discuss.elastic.co/t/logstash-8-11-reports-error-403/352224/3 "2024-01-31T20:58:04Z")

</div>

> [@andrew3](#):
>
> I am trying to connect logstash to elasticsearch. Both are on my local machine. I am using https.
> 
> Logstash reports error 403. Viz:
> 
> `
> 
> > {:code=\>403, :url=\>"[https://localhost:9200/\_bulk?filter\_path=errors,items.\*.error,items.\*.status](https://localhost:9200/_bulk?filter_path=errors,items.*.error,items.*.status)", :content\_length=\>2080, :body=\>"{"error":{"root\_cause":[{"type":"security\_exception","reason":"action [indices:data/write/bulk] is unauthorized for user [logstash\_system] with effective roles [logstash\_system], this action is granted by the index privileges [create\_doc,create,delete,index,write,all]"}]

Hi,

`logstash_system` user is a built-in user in Elasticsearch and it has a limited set of permissions, mainly for system operations like monitoring. It does not have permissions to write data to indices.

You can create a new user with the necessary permissions or use an existing user that has these permissions.

In the "Roles" section, assign the `logstash_writer` role to the user. This role has the necessary permissions to write data to indices.

Regards

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 31, 2024, 9:08pm UTC](https://discuss.elastic.co/t/logstash-8-11-reports-error-403/352224/4 "2024-01-31T21:08:42Z")

</div>

Yes, this is much better approach, please use `logstash_writer` or a dedicated user for your index.

> `logstash_system` - The user Logstash uses when storing monitoring information in Elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 28, 2024, 9:09pm UTC](https://discuss.elastic.co/t/logstash-8-11-reports-error-403/352224/5 "2024-02-28T21:09:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.