# Logstash - Getting failed install template **URL:** \ **Category:** Logstash\ **Created:** [December 3, 2015, 9:44pm UTC](https://discuss.elastic.co/t/logstash-getting-failed-install-template/36324 "2015-12-03T21:44:13Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\ **Post date:** [December 3, 2015, 9:44pm UTC](https://discuss.elastic.co/t/logstash-getting-failed-install-template/36324/1 "2015-12-03T21:44:13Z")
I am not able to get Elasticsearch with shield working with Logstash. Here is my output-config for logstash: output { elasticsearch { Protocol =\> "http" user =\> "ls\_user" password =\> "hulkicu4" hosts =\> "IP" } stdout { codec =\> rubydebug } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 4, 2015, 6:57am UTC](https://discuss.elastic.co/t/logstash-getting-failed-install-template/36324/2 "2015-12-04T06:57:58Z")
Please show the full error message from the Logstash log. ---
**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\ **Post date:** [December 4, 2015, 9:39pm UTC](https://discuss.elastic.co/t/logstash-getting-failed-install-template/36324/3 "2015-12-04T21:39:52Z")
output { elasticsearch { hosts =\> "IP" user =\> "name" password =\> "password" } stdout { codec =\> rubydebug } } {:timestamp=\>"2015-12-03T15:28:53.124000-0700", :message=\>"SIGTERM received. Shutting down the pipeline.", :level=\>:warn} {:timestamp=\>"2015-12-03T15:29:05.470000-0700", :message=\>"Failed to install template: [401] {"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication token for REST request [/\_template/logstash]","header":{"WWW-Authenticate":"Basic realm=\"shield\""}}],"type":"security\_exception","reason":"missing authentication token for REST request [/\_template/logstash]","header":{"WWW-Authenticate":"Basic realm=\"shield\""}},"status":401}", :level=\>:error} {:timestamp=\>"2015-12-03T16:59:12.885000-0700", :message=\>"SIGTERM received. Shutting down the pipeline.", :level=\>:warn} {:timestamp=\>"2015-12-04T13:44:57.745000-0700", :message=\>"SIGTERM received. Shutting down the pipeline.", :level=\>:warn} ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 5, 2015, 3:50pm UTC](https://discuss.elastic.co/t/logstash-getting-failed-install-template/36324/4 "2015-12-05T15:50:01Z")
So the error message indicates that Logstash isn't including authentication credentials with the HTTP request, which is surprising since you're supplying them. I'd use Wireshark or similar to find out whether Logstash is actually sending the credentials and, if so, if they're correct. ---
**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\ **Post date:** [December 7, 2015, 4:54pm UTC](https://discuss.elastic.co/t/logstash-getting-failed-install-template/36324/5 "2015-12-07T16:54:44Z")
Do I need to supply a port in my logstash elasticsearch output config or the cluster name? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 7, 2015, 6:28pm UTC](https://discuss.elastic.co/t/logstash-getting-failed-install-template/36324/6 "2015-12-07T18:28:02Z")
> Do I need to supply a port in my logstash elasticsearch output config Only if it's different from 9200. > or the cluster name? With the HTTP-only version of the plugin you're using there is to cluster name setting. ---
**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\ **Post date:** [December 8, 2015, 6:27pm UTC](https://discuss.elastic.co/t/logstash-getting-failed-install-template/36324/7 "2015-12-08T18:27:15Z")
So I have tried looking into this error... I've done a telnet with port 9200 and it's fine I've looked at firewalls and no issue there Based on my configuration on logstash is it correct or am I missing anything? I'm having issues understanding HTTP and transport protocol for the configuration. DO I need that declared in my config? Also, if I use transport protocol elastic says I need to install the transport plugin. Thanks for your help... ---
**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\ **Post date:** [December 8, 2015, 9:49pm UTC](https://discuss.elastic.co/t/logstash-getting-failed-install-template/36324/8 "2015-12-08T21:49:18Z")
I'm trying to avoid using wireshark due to not having a gui on my ubuntu logstash server and I don't have sudo without password access to run a remote ssh capture session with wireshark. Do you have any orther suggestions of help. I have redone all the elastic steps to setup shield with logstash and elasticsearch and am still getting: {:timestamp=\>"2015-12-07T15:56:50.099000-0700", :message=\>"Failed to install template: [401] {"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication token for REST request [/\_template/logstash]","header":{"WWW-Authenticate":"Basic realm=\"shield\""}}],"type":"security\_exception","reason":"missing authentication token for REST request [/\_template/logstash]","header":{"WWW-Authenticate":"Basic realm=\"shield\""}},"status":401}", :level=\>:error} {:timestamp=\>"2015-12-07T16:45:30.785000-0700", :message=\>"SIGTERM received. Shutting down the pipeline.", :level=\>:warn} ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:19am UTC](https://discuss.elastic.co/t/logstash-getting-failed-install-template/36324/9 "2017-07-06T05:19:27Z")