# LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError: Got response code '403' contacting Elasticsearch at URL 'http://localhost:9200/logstash' **URL:** \ **Category:** Logstash\ **Created:** [August 13, 2019, 4:11am UTC](https://discuss.elastic.co/t/logstash-got-response-code-403-contacting-elasticsearch-at-url-http-localhost-9200-logstash/194951 "2019-08-13T04:11:46Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Daniel6](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@Daniel6](https://discuss.elastic.co/u/Daniel6)\ **Post date:** [August 13, 2019, 4:11am UTC](https://discuss.elastic.co/t/logstash-got-response-code-403-contacting-elasticsearch-at-url-http-localhost-9200-logstash/194951/1 "2019-08-13T04:11:47Z")
Hi, I recently set security to elasticsearch. I configure elasticsearch by this [doc](https://www.elastic.co/guide/en/elasticsearch/reference/7.2/configuring-security.html) And configure logstash by this [doc](https://www.elastic.co/guide/en/logstash/7.2/ls-security.html) Here is my **logstash.yml** : ``` xpack.monitoring.enabled: true xpack.monitoring.elasticsearch.username: logstash_system xpack.monitoring.elasticsearch.password: my_logstash_system_password ``` And my **logstash.conf** : ``` input { file { path => "/userap/elk/log_file/*.log" codec => plain { charset => "ISO-8859-1" } start_position => "beginning" sincedb_path => "/dev/null" } } output{ elasticsearch { hosts => "localhost:9200" user => logstash_internal password => my_logstash_internal_password } } ``` When I run logstash, it shows: ``` Sending Logstash logs to /userap/elk/logstash-7.2.0/logs which is now configured via log4j2.properties [2019-08-,359][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2019-08-,374][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.2.0"} [2019-08-,224][INFO][logstash.monitoring.internalpipelinesource] Monitoring License OK [2019-08-,225][INFO][logstash.monitoring.internalpipelinesource] Validated license for monitoring. Enabling monitoring pipeline. [2019-08-,117][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://logstash_internal:xxxxxx@localhost:9200/]}} [2019-08-,156][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://logstash_internal:xxxxxx@localhost:9200/"} [2019-08-,163][INFO][logstash.outputs.elasticsearch] ES Output version determined {:es_version=>7} [2019-08-,164][WARN][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7} [2019-08-,192][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//localhost:9200"]} [2019-08-,237][INFO][logstash.outputs.elasticsearch] Using default mapping template [2019-08-,243][INFO][logstash.filters.elasticsearch] New ElasticSearch filter client {:hosts=>["localhost:9200"]} [2019-08-,407][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1, "index.lifecycle.name"=>"logstash-policy", "index.lifecycle.rollover_alias"=>"logstash"}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}} warning: thread "Ruby-0-Thread-5: :1" terminated with exception (report_on_exception is true): LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError: Got response code '403' contacting Elasticsearch at URL 'http://localhost:9200/logstash' perform_request at /userap/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:80 perform_request_to_url at /userap/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291 perform_request at /userap/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:278 with_connection at /userap/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:373 perform_request at /userap/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:277 Pool at /userap/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285 exists? at /userap/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:341 rollover_alias_exists? at /userap/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:359 maybe_create_rollover_alias at /userap/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/ilm.rb:91 setup_ilm at /userap/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/ilm.rb:10 setup_after_successful_connection at /userap/elk/logstash-7.2.0/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/common.rb:52 ``` How could I fix it? Thank you! Daniel. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 10, 2019, 4:11am UTC](https://discuss.elastic.co/t/logstash-got-response-code-403-contacting-elasticsearch-at-url-http-localhost-9200-logstash/194951/2 "2019-09-10T04:11:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.