# Logstash throwing error after enabling the xpack security

**URL:** <https://discuss.elastic.co/t/logstash-throwing-error-after-enabling-the-xpack-security/236256>\
**Category:** Logstash\
**Created:** [June 9, 2020, 3:28am UTC](https://discuss.elastic.co/t/logstash-throwing-error-after-enabling-the-xpack-security/236256 "2020-06-09T03:28:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mkbmanas87](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@mkbmanas87](https://discuss.elastic.co/u/mkbmanas87)\
**Post date:** [June 9, 2020, 3:28am UTC](https://discuss.elastic.co/t/logstash-throwing-error-after-enabling-the-xpack-security/236256/1 "2020-06-09T03:28:25Z")

</div>

```auto
Hi Team after enabling the xpack to create user in elasticsearch. The logstash is throwing error. 

Error:

logstash[9213][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://x.x.x.x:9200/", :error_type=>LogStash::Outputs::ElasticSearch ::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://x.x.x.x:9200/' "}

Please help me on this.

Elasticsearch version 7.2.1
Kibana Version 7.2.1
Logstash Version 7.2.0

```

---

<div class="post-metadata">

**Author:** ![mkbmanas87](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@mkbmanas87](https://discuss.elastic.co/u/mkbmanas87)\
**Post date:** [June 11, 2020, 10:40am UTC](https://discuss.elastic.co/t/logstash-throwing-error-after-enabling-the-xpack-security/236256/2 "2020-06-11T10:40:19Z")

</div>

> [@mkbmanas87](#):
>
> ```auto
> E
> 
> ```

Can anyone help me on this?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 11, 2020, 2:16pm UTC](https://discuss.elastic.co/t/logstash-throwing-error-after-enabling-the-xpack-security/236256/3 "2020-06-11T14:16:41Z")

</div>

401 is Unauthorized, so either the user and password supplied to the elasticsearch output is incorrect, or the user does not have the permissions required for whatever it is attempting to do.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2020, 2:20pm UTC](https://discuss.elastic.co/t/logstash-throwing-error-after-enabling-the-xpack-security/236256/4 "2020-07-09T14:20:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.