0}, @lut={}>, @cancelled=false>] {:level=>:warn, :file=>"logstash/outputs/elasticsearch.rb", :line=>"478", :method=>"submit"}
```
No index created in Elasticsearch
I tried with --debug, but it doesn't help me to solve the problem
Any idea to help me ?
Thanks
---
### Author:  [@suyograo](https://discuss.elastic.co/u/suyograo)
#### Post date: [June 23, 2015, 6:29am UTC](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113/2 "2015-06-23T06:29:19Z")
are you able to connect to the ES cluster using `curl` and basic auth? I would check that first to rule out any setup issues in ES Shield. If everything is fine with `curl` we can debug the LS side
---
### Author:  [@marjolaine](https://discuss.elastic.co/u/marjolaine)
#### Post date: [June 23, 2015, 7:23am UTC](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113/3 "2015-06-23T07:23:01Z")
I make the test with
```
curl -XGET 'http://localhost:9200/*?pretty' --user admin:password
```
I have no problem, all my index appear.
So I haven't problem with Elasticsearch. It really Logstash which have problem
---
### Author:  [@marjolaine](https://discuss.elastic.co/u/marjolaine)
#### Post date: [June 23, 2015, 10:16am UTC](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113/4 "2015-06-23T10:16:57Z")
When I put --verbose I have those messages which appear.
```
Using version 0.1.x input plugin 'stdin'. This plugin isn't well supported by the community and likely has no maintainer. {:level=>:info}
Using version 0.1.x codec plugin 'line'. This plugin isn't well supported by the community and likely has no maintainer. {:level=>:info}
Using version 0.1.x output plugin 'stdout'. This plugin isn't well supported by the community and likely has no maintainer. {:level=>:info}
Using version 0.1.x codec plugin 'rubydebug'. This plugin isn't well supported by the community and likely has no maintainer. {:level=>:info}
Using version 0.1.x output plugin 'elasticsearch'. This plugin isn't well supported by the community and likely has no maintainer. {:level=>:info}
Using version 0.1.x codec plugin 'plain'. This plugin isn't well supported by the community and likely has no maintainer. {:level=>:info}
```
Before I was in version 1.4.2 of logstash and I it was working, I install the version 1.5.1 with the rpm to be compatible with shield, but apparently the versions of logstash plugins are not updated.
Can it explain why I have the message "failed action with response of 404" ? How can I update those plugin (my server is not connect to internet)?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 23, 2015, 11:04am UTC](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113/5 "2015-06-23T11:04:52Z")
You should ignore the "This plugin isn't well supported by the community" messages. It's unrelated to your 404 problem.
---
### Author:  [@marjolaine](https://discuss.elastic.co/u/marjolaine)
#### Post date: [June 24, 2015, 1:19pm UTC](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113/6 "2015-06-24T13:19:08Z")
I find why I have this message.
In my config file of ES I have :
```
http.port: 9200
```
And in my config file of Logstash don't say the port in output elasticsearch. I used the default port. But in Logstash 1.5.1, the default port is not 9200. So I add in Logstash config :
```
elasticsearch {
...
port => 9200
...
}
```
And now it works !
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 24, 2015, 1:52pm UTC](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113/7 "2015-06-24T13:52:05Z")
That's odd. According to [the documentation](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-port), port 9200 is the default with `protocol => http`. It sounds like either the documentation or the code is buggy.
---
### Author:  [@suyograo](https://discuss.elastic.co/u/suyograo)
#### Post date: [June 26, 2015, 5:41am UTC](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113/8 "2015-06-26T05:41:09Z")
The default is indeed 9200 if you use http protocol. Can you stick your full ES config here (without the username/password)
---
### Author:  [@suyograo](https://discuss.elastic.co/u/suyograo)
#### Post date: [June 26, 2015, 5:42am UTC](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113/9 "2015-06-26T05:42:03Z")
Ah never mind, I see your config on top. This is weird. So adding the port fixed the issue?
---
### Author:  [@marjolaine](https://discuss.elastic.co/u/marjolaine)
#### Post date: [June 26, 2015, 7:14am UTC](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113/10 "2015-06-26T07:14:02Z")
This is my complete ES configuration: elasticsearch.yml :
```
marvel.agent.exporter.es.hosts: ["username:password@slnxelknode01.simat.ntes.ext.sopra:9200"]
action.auto_create_index: .marvel-*
shield:
authc:
realms:
realm_name:
type: esusers
files:
users: /usr/share/elasticsearch/config/shield/users
users_roles: /usr/share/elasticsearch/config/shield/users_roles
cluster.name: simat
bootstrap.mlockall: true
http.port: 9200
```
I know it's weird, but when I add the port in my logastash conf, it works !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:36am UTC](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113/11 "2017-07-06T05:36:22Z")