# Logstash server errors
**URL:** https://discuss.elastic.co/t/logstash-server-errors/79494
**Category:** Logstash
**Created:** [March 21, 2017, 7:12pm UTC](https://discuss.elastic.co/t/logstash-server-errors/79494 "2017-03-21T19:12:52Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@rmelton](https://discuss.elastic.co/u/rmelton)
#### Post date: [March 21, 2017, 7:12pm UTC](https://discuss.elastic.co/t/logstash-server-errors/79494/1 "2017-03-21T19:12:52Z")
installed ELK stack 5.2.2 on ubuntu 14.04 server image and put 5.2.2 filebeat on 5 other servers to send logs up to logstash.
I can curl elasticsearch and login to kibana but my new logstash is **flooding errors into logstash-plain.log** and i am **not getting any new logs into elasticsearch**.
here is the logstash error message in logstash-plain.log:
[2017-03-21T13:58:50,496][ERROR][logstash.outputs.elasticsearch] Got a bad response code from server, but this code is not considered retryable. Request will be dropped {:code=\>401, :response\_body=\>"{"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication token for REST request [/\_bulk]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security\_exception","reason":"missing authentication token for REST request [/\_bulk]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}"}
i validated logstash config files and restarted logstash:
sudo bin/logstash --config.test\_and\_exit --path.settings /etc/logstash
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
**Configuration OK**
logstash does not seem to be crashing and restarting - process ID is not changing.
Any idea what this error is about and how to fix it?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 21, 2017, 8:27pm UTC](https://discuss.elastic.co/t/logstash-server-errors/79494/2 "2017-03-21T20:27:33Z")
> [@rmelton](#):
>
> missing authentication token for REST request
Have you set auth details?
---
### Author:  [@rmelton](https://discuss.elastic.co/u/rmelton)
#### Post date: [March 21, 2017, 8:53pm UTC](https://discuss.elastic.co/t/logstash-server-errors/79494/3 "2017-03-21T20:53:49Z")
i think API auth should just be basic auth. how can i set this up for REST APIs? do i put something in the output file for this? does user have to be logstash\_internal user?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 21, 2017, 9:34pm UTC](https://discuss.elastic.co/t/logstash-server-errors/79494/4 "2017-03-21T21:34:46Z")
[https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-user](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-user)
[https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-password](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-password)
[https://www.elastic.co/guide/en/x-pack/current/logstash.html](https://www.elastic.co/guide/en/x-pack/current/logstash.html)
They should get you started 🙂
---
### Author:  [@rmelton](https://discuss.elastic.co/u/rmelton)
#### Post date: [March 22, 2017, 11:41pm UTC](https://discuss.elastic.co/t/logstash-server-errors/79494/5 "2017-03-22T23:41:18Z")
I think i have followed the instrucitons in the links which you sent. i'm still getting a continual error (and log message) when logstash tries to process my input plugin.
Here's the error caused by my input plugin:
[2017-03-22T18:19:38,779][ERROR][logstash.agent] Cannot load an invalid configuration {:reason=\>"Expected one of #, { at line 6, column 6 (byte 48) after input{\nbeats{\nport =\> 5044\ntype =\> logs\n}\nuser "}
It's flagging an error with the 'user' parameter. I tried many different forms of indentation, etc. nothing works.
if i comment out, user and password, the input plugin is processed correct.
here's my input plugin:cat -n 02-filebeat-input.conf
1 input{
2 beats{
3 port =\> 5044
4 type =\> logs
5 }
6 user =\> logstash\_internal
7 password =\> changeme
8 }
I followed the instructions at this link [https://www.elastic.co/guide/en/x-pack/current/logstash.html](https://www.elastic.co/guide/en/x-pack/current/logstash.html) - but looks like logstash doesn't follow its own documentation.
When i comment out the user and password in input, i see same problem in filter plugin. if i comment out user and pw in input and filter, i see same problem in output plugin.
I verified that i am using logstash 5.2.2
lx=stack@login: os=admin /usr/share/logstash$ **sudo bin/logstash --version**
**logstash 5.2.2**
Any idea why it is rejecting my user and password parameters?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 23, 2017, 2:18am UTC](https://discuss.elastic.co/t/logstash-server-errors/79494/6 "2017-03-23T02:18:24Z")
You don't need user details for inputs, just for outputs.
---
### Author:  [@rmelton](https://discuss.elastic.co/u/rmelton)
#### Post date: [March 24, 2017, 8:45pm UTC](https://discuss.elastic.co/t/logstash-server-errors/79494/7 "2017-03-24T20:45:22Z")
ok, i removed user and password from input and filter plugins and only have it in output plugin.
still getting continual error in logstash log file when logstash starts:
[2017-03-24T15:40:42,791][ERROR][logstash.agent] Cannot load an invalid configuration {:reason=\>"Expected one of #, { at line 26, column 6 (byte 469) after output **{\nuser "}**
It is still choking on 'user' even in the output plugin.
here is my output plugin. i have tried moving user and password various places within the plugin - no
success.
output {
user =\> logstash\_internal
password =\> changeme
elasticsearch { hosts =\> ["localhost:9200"] }
stdout { codec =\> rubydebug }
}
thanks for the help - any further ideas?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 25, 2017, 12:20am UTC](https://discuss.elastic.co/t/logstash-server-errors/79494/8 "2017-03-25T00:20:11Z")
They need to go inside the Elasticsearch section, that is what they relate to.
---
### Author:  [@rmelton](https://discuss.elastic.co/u/rmelton)
#### Post date: [March 26, 2017, 8:57pm UTC](https://discuss.elastic.co/t/logstash-server-errors/79494/9 "2017-03-26T20:57:27Z")
OK, it works when i put username and password in elasticsearch part of output plugin.
Here is final output plugin which made it work correctly.
lx=stack@login: os=admin **/etc/logstash/conf.d$ cat 30-elasticsearch-output.conf**
output {
elasticsearch { hosts =\> ["localhost:9200"] **user =\> logstash\_internal password =\> yourpassword** }
stdout { codec =\> rubydebug }
}
thanks for the help.
---
### Author:  [@rmelton](https://discuss.elastic.co/u/rmelton)
#### Post date: [March 26, 2017, 9:00pm UTC](https://discuss.elastic.co/t/logstash-server-errors/79494/10 "2017-03-26T21:00:05Z")
see above fix to logstash output plugin. logstash working correctly.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 23, 2017, 9:00pm UTC](https://discuss.elastic.co/t/logstash-server-errors/79494/11 "2017-04-23T21:00:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.