# Logstash Management user with default logstash\_admin rol prevents logstash from starting

**URL:** <https://discuss.elastic.co/t/logstash-management-user-with-default-logstash-admin-rol-prevents-logstash-from-starting/180180>\
**Category:** Logstash\
**Created:** [May 8, 2019, 1:35pm UTC](https://discuss.elastic.co/t/logstash-management-user-with-default-logstash-admin-rol-prevents-logstash-from-starting/180180 "2019-05-08T13:35:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![searchtool](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@searchtool](https://discuss.elastic.co/u/searchtool)\
**Post date:** [May 8, 2019, 1:35pm UTC](https://discuss.elastic.co/t/logstash-management-user-with-default-logstash-admin-rol-prevents-logstash-from-starting/180180/1 "2019-05-08T13:35:59Z")

</div>

Hi,

i noticed when using the out of the box role logstash admin for a user as described in the [docs](https://www.elastic.co/guide/en/logstash/7.0/configuring-centralized-pipelines.html)

> `xpack.management.elasticsearch.username` and `xpack.management.elasticsearch.password`  
> If your Elasticsearch cluster is protected with basic authentication, these settings provide the username and password that the Logstash instance uses to authenticate for accessing the configuration data. **The username you specify here should have the `logstash_admin` role** , which provides access to `.logstash-*` indices for managing configurations.

Logstash will not start due to an failing bootstrapcheck.

```
May 08 15:25:03 host1 logstash[12370]: Sending Logstash logs to /var/log/logstash/ which is now configured via log4j2.properties
May 08 15:25:03 host1 logstash[12370]: [2019-05-08T15:25:03,277][INFO][logstash.configmanagement.bootstrapcheck] Using Elasticsearch as config store {:pipeline_id=>["Beats"], :poll_interval=>"5000000000ns"}`
May 08 15:25:04 host1 logstash[12370]: [2019-05-08T15:25:04,687][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"Got responsecode '403' contacting Elasticsearch at URL 'https://host1:9200/_xpack'"}
May 08 15:25:04 host1 logstash[12370]: [2019-05-08T15:25:04,731][ERROR][logstash.configmanagement.elasticsearchsource] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.
May 08 15:25:04 host1 logstash[12370]: [2019-05-08T15:25:04,738][FATAL][logstash.runner] An unexpected error occurred! {:error=>#<LogStash::LicenseChecker::LicenseError: Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster
May 08 15:25:04 host1 logstash[12370]: [2019-05-08T15:25:04,748][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
 May 08 15:26:42 host1 systemd[1]: logstash.service: main process exited, code=exited, status=1/FAILURE

```

I found out that when i use a superuser account for management the xpack license check completes ok.

is there more to it ? or did i fail somewhere 🙂

elastic, logstash 7.0.1

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 5, 2019, 1:36pm UTC](https://discuss.elastic.co/t/logstash-management-user-with-default-logstash-admin-rol-prevents-logstash-from-starting/180180/2 "2019-06-05T13:36:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.