# Logstash + shield giving authentication error \[401\]

**URL:** <https://discuss.elastic.co/t/logstash-shield-giving-authentication-error-401/29453>\
**Category:** Logstash\
**Created:** [September 17, 2015, 6:22am UTC](https://discuss.elastic.co/t/logstash-shield-giving-authentication-error-401/29453 "2015-09-17T06:22:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![codinguari](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@codinguari](https://discuss.elastic.co/u/codinguari)\
**Post date:** [September 17, 2015, 6:22am UTC](https://discuss.elastic.co/t/logstash-shield-giving-authentication-error-401/29453/1 "2015-09-17T06:22:12Z")

</div>

I'm getting the following error while trying to output data to elasticsearch from logstash:

```
Failed to install template: [401] {"error":"AuthenticationException[unable to authenticate user [es_admin] for REST request [/_template/logstash]]","status":401} {:level=>:error}

```

I have the configuration like this in logstash:

> if [type]=="signup"{  
> elasticsearch {  
> protocol =\> "http"  
> user =\>"\*\*\*\*\*"  
> password =\>"\*\*\*\*\*\*\*"  
> document\_type =\> "signup"  
> host =\> "localhost"  
> index =\> "signups"  
> }  
> }

I have tried adding user with following commands:  
esusers useradd -p -r logstash

I also tried giving role admin but logstash not working for admin user also. The localhost:9200 is asking for the password and after entering the password it works but the logstash is giving an error.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 19, 2015, 1:10am UTC](https://discuss.elastic.co/t/logstash-shield-giving-authentication-error-401/29453/2 "2015-09-19T01:10:55Z")

</div>

Try setting debug logging on in Shield to see what is happening;

```auto
PUT /_cluster/settings
{
    "transient" : {
        "shield.authc" : "DEBUG"
    }
}

```

That should work and provide you with more output.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:28am UTC](https://discuss.elastic.co/t/logstash-shield-giving-authentication-error-401/29453/3 "2017-07-06T05:28:41Z")

</div>