# Logstash won't authenticate with elasticsearch

**URL:** https://discuss.elastic.co/t/logstash-wont-authenticate-with-elasticsearch/129807
**Category:** Logstash
**Created:** [April 27, 2018, 10:04am UTC](https://discuss.elastic.co/t/logstash-wont-authenticate-with-elasticsearch/129807 "2018-04-27T10:04:09Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![jarnold](https://avatars.discourse-cdn.com/v4/letter/j/df788c/32.png) [@jarnold](https://discuss.elastic.co/u/jarnold)
#### Post date: [April 27, 2018, 10:04am UTC](https://discuss.elastic.co/t/logstash-wont-authenticate-with-elasticsearch/129807/1 "2018-04-27T10:04:09Z")

</div>

Hello,

I'm setting up a new stack & i'm having some trouble with my logstash authentication. I'm getting this error after startup;

```
Sending Logstash's logs to /usr/share/logstash/logs which is now configured via log4j2.properties
Got response code '401' contacting Elasticsearch at URL 'http://localhost:9200/_xpack'

```

Which repeats ad-infinitum.

My logstash.yml is as follows;

[Pastebin link](https://pastebin.com/LgrZmKAN) as it's too many characters otherwise

And my pipeline configuration is currently this;

```
input {
  beats {
    port => "5044"
  }
}

filter {
  grok {
    match => { "message" => "%{GREEDYDATA}"}
  }
}

output {
  elasticsearch {
    hosts => ["172.19.32.154"]
    user => "logstash_system"
    password => "password"
  }
}

```

I've tried using the elastic user as well as logstash\_system. If I curl or browse to 172.19.32.154:9200/\_xpack & use these credentials it works, no errors.

Disabling xpack security in elasticsearch resolves the issue - Obviously this is not ideal as I would like to use security.

One thing that seems odd is that logstash is attempting to connect to localhost:9200. This is fine as elasticsearch's host address is set to 0.0.0.0 but nowhere in my logstashs config is localhost specified, it's always stated as 172.19.32.154. This leads me to believe logstash isn't loading my config, despite getting the same error when using the --path.settings flag.

Thanks

---

<div class="post-metadata">

### Author: ![jarnold](https://avatars.discourse-cdn.com/v4/letter/j/df788c/32.png) [@jarnold](https://discuss.elastic.co/u/jarnold)
#### Post date: [April 30, 2018, 9:17am UTC](https://discuss.elastic.co/t/logstash-wont-authenticate-with-elasticsearch/129807/2 "2018-04-30T09:17:10Z")

</div>

Anyone?

I'm currently running without authentication, but this is not ideal. Help would be appreciated.

---

<div class="post-metadata">

### Author: ![jarnold](https://avatars.discourse-cdn.com/v4/letter/j/df788c/32.png) [@jarnold](https://discuss.elastic.co/u/jarnold)
#### Post date: [May 4, 2018, 2:29pm UTC](https://discuss.elastic.co/t/logstash-wont-authenticate-with-elasticsearch/129807/3 "2018-05-04T14:29:54Z")

</div>

Bumping this again for visibility. From what I understand I only need my username and password in the output section of my pipeline. However this doesn't work. Any ideas?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 1, 2018, 2:30pm UTC](https://discuss.elastic.co/t/logstash-wont-authenticate-with-elasticsearch/129807/4 "2018-06-01T14:30:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.