# Logstash not work after enable xpack.security **URL:** \ **Category:** Logstash\ **Created:** [May 30, 2019, 11:44pm UTC](https://discuss.elastic.co/t/logstash-not-work-after-enable-xpack-security/183631 "2019-05-30T23:44:48Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Mrcow](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Post date:** [May 30, 2019, 11:44pm UTC](https://discuss.elastic.co/t/logstash-not-work-after-enable-xpack-security/183631/1 "2019-05-30T23:44:48Z")
Recently i enabled xpack.security en elasticsearch but logstash stop working and i got this error: ``` [2019-05-30T17:16:08,636][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://10.11.7.20:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://10.11.7.20:9200/'"} ``` my logstash conf file /etc/logstash/logstash.yml is path.data: /var/lib/logstash path.logs: /var/log/logstash xpack.monitoring.enabled: true xpack.monitoring.elasticsearch.username: "logstash\_system" xpack.monitoring.elasticsearch.password: "Kz8twlWy9i3NWBZOYR1T" xpack.monitoring.elasticsearch.hosts: ["[https://10.11.7.20:9200](https://10.11.7.20:9200)", "[https://10.11.7.17:9200](https://10.11.7.17:9200)"] xpack.monitoring.elasticsearch.url: "[http://10.11.7.20:9200](http://10.11.7.20:9200)" xpack.management.enabled: true xpack.management.elasticsearch.url: "[http://10.11.7.20:9200](http://10.11.7.20:9200)" my /etc/logstash/conf.d/syslog-input.conf file is the next input { elasticsearch { hosts =\> ["10.11.7.20:9200"] user =\> "logstash\_system" password =\> "Kz8twlWy9i3NWBZOYR1T" } } output { elasticsearch { hosts =\> ["10.11.7.20:9200"] user =\> "logstash\_system" password =\> "Kz8twlWy9i3NWBZOYR1T" } } filter { elasticsearch { hosts =\> ["10.11.7.20:9200"] user =\> "logstash\_system" password =\> "Kz8twlWy9i3NWBZOYR1T" } if [type] == "quagga" { grok { patterns\_dir =\> ["/etc/logstash/patterns"] match =\> ["message", "%{UPDATE1}"] overwrite =\> ["message"] } } } And my logstash is not working after enable the authentication login for kibana, what can i do? if i use a curl like this on the server it works curl -u logstash\_system:Kz8twlWy9i3NWBZOYR1T [http://10.11.7.20:9200/\_cluster/health](http://10.11.7.20:9200/_cluster/health) {"cluster\_name":"ttco-elk","status":"yellow","timed\_out":false,"number\_of\_nodes":1,"number\_of\_data\_nodes":1,"active\_primary\_shards":19,"active\_shards":19,"relocating\_shards":0,"initializing\_shards":0,"unassigned\_shards":1,"delayed\_unassigned\_shards":0,"number\_of\_pending\_tasks":0,"number\_of\_in\_flight\_fetch":0,"task\_max\_waiting\_in\_queue\_millis":0,"active\_shards\_percent\_as\_number":95.0} ---
**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\ **Post date:** [June 10, 2019, 8:48pm UTC](https://discuss.elastic.co/t/logstash-not-work-after-enable-xpack-security/183631/2 "2019-06-10T20:48:50Z")
I had the same issue, I believe that the logstash\_system user is buggered up. Create a new user in elasticsearch and give it the proper write access to the index patterns you want it to be able to write to. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 8, 2019, 8:49pm UTC](https://discuss.elastic.co/t/logstash-not-work-after-enable-xpack-security/183631/3 "2019-07-08T20:49:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.