# Logstash - X-pack error conencting to ES

**URL:** <https://discuss.elastic.co/t/logstash-x-pack-error-conencting-to-es/128398>\
**Category:** Logstash\
**Created:** [April 17, 2018, 4:14pm UTC](https://discuss.elastic.co/t/logstash-x-pack-error-conencting-to-es/128398 "2018-04-17T16:14:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robert\_Bardo](https://avatars.discourse-cdn.com/v4/letter/r/e9bcb4/32.png) [@Robert\_Bardo](https://discuss.elastic.co/u/Robert_Bardo)\
**Post date:** [April 17, 2018, 4:14pm UTC](https://discuss.elastic.co/t/logstash-x-pack-error-conencting-to-es/128398/1 "2018-04-17T16:14:39Z")

</div>

Hello,

Does anyone know the cause of this error?

Could not fetch all the sources {:exception=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=\>"Got response code '403' contacting Elasticsearch at URL '[http://elasticsearch:9200/.logstash/doc/\_mget](http://elasticsearch:9200/.logstash/doc/_mget)'"

I am running in a docker container with x-pack plugin installed and configured to use the logstash\_system user after setting the password using the util on ES.

thanks!!

---

<div class="post-metadata">

**Author:** ![jdnewhouse](https://avatars.discourse-cdn.com/v4/letter/j/f6c823/32.png) [@jdnewhouse](https://discuss.elastic.co/u/jdnewhouse)\
**Post date:** [April 17, 2018, 4:55pm UTC](https://discuss.elastic.co/t/logstash-x-pack-error-conencting-to-es/128398/2 "2018-04-17T16:55:27Z")

</div>

The logstash\_system account is created as a reserved account when you install X-pack to use with logstash monitoring. It is not meant to be used to write data to Elastic with.

You will need to create a separate account such as the logstash\_internal account to use with your logstash pipelines as described here:

[https://www.elastic.co/guide/en/logstash/current/ls-security.html](https://www.elastic.co/guide/en/logstash/current/ls-security.html)

---

<div class="post-metadata">

**Author:** ![Robert\_Bardo](https://avatars.discourse-cdn.com/v4/letter/r/e9bcb4/32.png) [@Robert\_Bardo](https://discuss.elastic.co/u/Robert_Bardo)\
**Post date:** [April 17, 2018, 8:16pm UTC](https://discuss.elastic.co/t/logstash-x-pack-error-conencting-to-es/128398/3 "2018-04-17T20:16:19Z")

</div>

dang it! I was so close - I had a new user created it and only gave it logstash related roles - not index related security roles.

thanks!

considered solved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2018, 8:16pm UTC](https://discuss.elastic.co/t/logstash-x-pack-error-conencting-to-es/128398/4 "2018-05-15T20:16:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.