# Logstash error after filebeat restarted **URL:** \ **Category:** Logstash\ **Created:** [June 15, 2016, 6:56am UTC](https://discuss.elastic.co/t/logstash-error-after-filebeat-restarted/52819 "2016-06-15T06:56:49Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ivanandrianto95](https://avatars.discourse-cdn.com/v4/letter/i/48db29/32.png) [@ivanandrianto95](https://discuss.elastic.co/u/ivanandrianto95)\ **Post date:** [June 15, 2016, 6:56am UTC](https://discuss.elastic.co/t/logstash-error-after-filebeat-restarted/52819/1 "2016-06-15T06:56:49Z")
I got error in Logstash every time I restart Filebeat. To make logstash work again, I have to kll the Logstash process and restart it. How to fix it? Here is the error > {:timestamp=\>"2016-06-15T00:48:30.697000-0400", :message=\>"Attempted to send a bulk request to Elasticsearch configured at '["[http://127.0.0.1:9200/\](http://127.0.0.1:9200/%5C)"]', but an error occurred and it failed! Are you sure you can reach elasticsearch from this machine using the configuration provided?", :error\_message=\>"[403] {"error":{"root\_cause":[{"type":"security\_exception","reason":"action [indices:data/write/bulk] is unauthorized for user [user\_agent]"}],"type":"security\_exception","reason":"action [indices:data/write/bulk] is unauthorized for user [user\_agent]"},"status":403}", :error\_class=\>"Elasticsearch::Transport::Transport::Errors::Forbidden", :backtrace=\>["/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.17/lib/elasticsearch/transport/transport/base.rb:201:in `__raise_transport_error'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.17/lib/elasticsearch/transport/transport/base.rb:312:in `perform\_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.17/lib/elasticsearch/transport/transport/http/manticore.rb:67:in `perform_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.17/lib/elasticsearch/transport/client.rb:128:in `perform\_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-api-1.0.17/lib/elasticsearch/api/actions/bulk.rb:88:in `bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:53:in `non\_threadsafe\_bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/http\_client.rb:38:in `bulk'", "org/jruby/ext/thread/Mutex.java:149:in `synchronize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/http\_client.rb:38:in `bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/common.rb:164:in `safe\_bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/common.rb:101:in `submit'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/common.rb:86:in `retrying\_submit'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/common.rb:29:in `multi_receive'", "org/jruby/RubyArray.java:1653:in `each\_slice'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/common.rb:28:in `multi_receive'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/output_delegator.rb:130:in `worker\_multi\_receive'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/output\_delegator.rb:129:in `worker_multi_receive'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/output_delegator.rb:114:in `multi\_receive'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/pipeline.rb:301:in `output_batch'", "org/jruby/RubyHash.java:1342:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/pipeline.rb:301:in `output_batch'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/pipeline.rb:232:in `worker\_loop'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/pipeline.rb:201:in `start_workers'"], :client_config=>{:hosts=>["http://127.0.0.1:9200/"], :ssl=>nil, :transport_options=>{:socket_timeout=>0, :request_timeout=>0, :proxy=>nil, :ssl=>{}}, :transport_class=>Elasticsearch::Transport::Transport::HTTP::Manticore, :headers=>{"Authorization"=>"Basic Y2VybWF0aV9hZ2VudDpDZXJtYXRIZWJhdA=="}, :logger=>nil, :tracer=>nil, :reload_connections=>false, :retry_on_failure=>false, :reload_on_failure=>false, :randomize_hosts=>false, :http=>{:scheme=>"http", :user=>nil, :password=>nil, :port=>9200}}, :level=>:error}` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 15, 2016, 10:06pm UTC](https://discuss.elastic.co/t/logstash-error-after-filebeat-restarted/52819/2 "2016-06-15T22:06:00Z")
That's a 403 error, ie an authorisation one. Are you using shield? ---
**Author:** ![ivanandrianto95](https://avatars.discourse-cdn.com/v4/letter/i/48db29/32.png) [@ivanandrianto95](https://discuss.elastic.co/u/ivanandrianto95)\ **Post date:** [June 22, 2016, 2:43am UTC](https://discuss.elastic.co/t/logstash-error-after-filebeat-restarted/52819/3 "2016-06-22T02:43:13Z")
Yes I'm using shield ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:51am UTC](https://discuss.elastic.co/t/logstash-error-after-filebeat-restarted/52819/4 "2017-07-06T04:51:19Z")
Closed on July 6, 2017, 4:51am UTC