# Logstash not starting after upgrade

**URL:** <https://discuss.elastic.co/t/logstash-not-starting-after-upgrade/187573>\
**Category:** Logstash\
**Created:** [June 26, 2019, 1:02pm UTC](https://discuss.elastic.co/t/logstash-not-starting-after-upgrade/187573 "2019-06-26T13:02:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hriegger](https://avatars.discourse-cdn.com/v4/letter/h/ec9cab/32.png) [@hriegger](https://discuss.elastic.co/u/hriegger)\
**Post date:** [June 26, 2019, 1:02pm UTC](https://discuss.elastic.co/t/logstash-not-starting-after-upgrade/187573/1 "2019-06-26T13:02:30Z")

</div>

After upgrading logstash to 7.1.1 and activating xpack security logstash does not start

Log:

> [@hriegger](#):
>
> Jun 26 14:26:53 syslogbicp1 logstash[21260]: [2019-06-26T14:26:53,420][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["[//127.0.0.1](https://127.0.0.1)"]}  
> Jun 26 14:26:53 syslogbicp1 logstash[21260]: warning: thread "Ruby-0-Thread-7: :1" terminated with exception (report\_on\_exception is true):  
> Jun 26 14:26:53 syslogbicp1 logstash[21260]: LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError: **Got response code '403' contacting Elasticsearch at URL '[http://127.0.0.1:9200/logstash](http://127.0.0.1:9200/logstash)'**

03-output.conf

> [@hriegger](#):
>
> output {  
> elasticsearch {  
> manage\_template =\> false  
> user =\> "logstash"  
> password =\> ""  
> index =\> "logstash-%{+YYYY.MM.dd}"  
> }

role logstash\_writer

> [@hriegger](#):
>
> { "logstash\_writer" : {  
> "cluster" : ["manage\_index\_templates", "monitor", "manage\_ilm"],  
> "indices" : [  
> {  
> "names" : ["logstash-\*"],  
> "privileges" : ["write", "delete", "create\_index", "manage", "manage\_ilm"],  
> "allow\_restricted\_indices" : false  
> } ],  
> "applications" : [],  
> "run\_as" : [],  
> "metadata" : { },  
> "transient\_metadata" : { "enabled" : true }  
> }}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2019, 1:02pm UTC](https://discuss.elastic.co/t/logstash-not-starting-after-upgrade/187573/2 "2019-07-24T13:02:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.