[2021-06-06T08:38:50,640][WARN ][logstash.outputs.amazonelasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://search-xxxxxx-elasticsearch-n2wtsxzzf23iyifadn4mi2fmfy.us-east-1.es.amazonaws.com:443/", :error_type=>LogStash::Outputs::AmazonElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '403' contacting Elasticsearch at URL 'https://search-xxxxxx-elasticsearch-n2wtsxzzf23iyifadn4mi2fmfy.us-east-1.es.amazonaws.com:443/'"}
Finally i Figured out kibana user also need to allow the ec2 role with es access