# Logstash failed to create template on target server

**URL:** <https://discuss.elastic.co/t/logstash-failed-to-create-template-on-target-server/256232>\
**Category:** Logstash\
**Created:** [November 21, 2020, 3:16pm UTC](https://discuss.elastic.co/t/logstash-failed-to-create-template-on-target-server/256232 "2020-11-21T15:16:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amralieg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amralieg/32/49943_2.png) [@amralieg](https://discuss.elastic.co/u/amralieg)\
**Post date:** [November 21, 2020, 3:16pm UTC](https://discuss.elastic.co/t/logstash-failed-to-create-template-on-target-server/256232/1 "2020-11-21T15:16:22Z")

</div>

Hi, I have the following logstash configuration, and when I run it it gives me the error.  
the input server is hosted on elastic cloud v7.9 and the output server is hosted on AWS elasticsearch v7.8, any clue how to solve this error?

```auto
[2020-11-21T15:07:45,444][ERROR][logstash.outputs.elasticsearch][main] Failed to install template. 
{:message=>"Got response code '401' contacting Elasticsearch at URL 
'https://xxx.eu-west-1.es.amazonaws.com:443/_xpack'"

```

this is the logstash config file

```auto
input {
    elasticsearch {
        hosts => ["https://yyy.eu-west-1.aws.found.io:443"]
        user => "xxx"
        password => "xxx"
        index => "idx-1,idx-2"
        size => 10
        scroll => "10m"
        codec => "json"
        docinfo => true
    }
}

filter {
    mutate { remove_field => ["@version", "@timestamp"] }
}

output {
    elasticsearch {
        document_id => "%{[@metadata][_id]}"
        hosts => ["https://xxx.es.amazonaws.com:443"]
        user => "xxx"
        password => "xxx"
        index => "%{[@metadata][_index]}"
    }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 21, 2020, 4:13pm UTC](https://discuss.elastic.co/t/logstash-failed-to-create-template-on-target-server/256232/2 "2020-11-21T16:13:15Z")

</div>

> [@amralieg](#):
>
> ```auto
> "Got response code '401' contacting Elasticsearch at URL 
> 'https://xxx.eu-west-1.es.amazonaws.com:443/_xpack'"
> 
> ```

A 401 error is 'Unauthorized'. You have supplied a user/password, and a 401 error suggests that they are valid, but do not have the permissions required.

[This](https://www.elastic.co/guide/en/logstash/current/ls-security.html) document describes the roles that should be granted to the user used in an elasticsearch output.

---

<div class="post-metadata">

**Author:** ![amralieg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amralieg/32/49943_2.png) [@amralieg](https://discuss.elastic.co/u/amralieg)\
**Post date:** [November 23, 2020, 10:53am UTC](https://discuss.elastic.co/t/logstash-failed-to-create-template-on-target-server/256232/3 "2020-11-23T10:53:21Z")

</div>

Thanks, I'll look into this and see if it works.

---

<div class="post-metadata">

**Author:** ![amralieg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amralieg/32/49943_2.png) [@amralieg](https://discuss.elastic.co/u/amralieg)\
**Post date:** [November 23, 2020, 2:17pm UTC](https://discuss.elastic.co/t/logstash-failed-to-create-template-on-target-server/256232/4 "2020-11-23T14:17:46Z")

</div>

I am using the super user (elastic) with the following permission, it is assigned to the all\_access role which has the following definition, I am not sure what other permission needed for this user to be able to overcome the error above? My worry is that logstash tries to install a template that requires a specific plugin to be installed, is that the case?

```auto
{
  "description": "Allow full access to all indices and all cluster APIs",
  "index_permissions": [
    {
      "index_patterns": [
        "*"
      ],
      "fls": [],
      "masked_fields": [],
      "allowed_actions": [
        "*"
      ]
    }
  ],
  "tenant_permissions": [
    {
      "tenant_patterns": [
        "*"
      ],
      "allowed_actions": [
        "kibana_all_write"
      ]
    }
  ],
  "cluster_permissions": [
    "*"
  ]
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2020, 2:17pm UTC](https://discuss.elastic.co/t/logstash-failed-to-create-template-on-target-server/256232/5 "2020-12-21T14:17:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.