# Metricbeat Beat failed to connect es (xpack enabled)

**URL:** <https://discuss.elastic.co/t/metricbeat-beat-failed-to-connect-es-xpack-enabled/230500>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [April 30, 2020, 8:37am UTC](https://discuss.elastic.co/t/metricbeat-beat-failed-to-connect-es-xpack-enabled/230500 "2020-04-30T08:37:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paul\_20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_20/32/63977_2.png) [@Paul\_20](https://discuss.elastic.co/u/Paul_20)\
**Post date:** [April 30, 2020, 8:37am UTC](https://discuss.elastic.co/t/metricbeat-beat-failed-to-connect-es-xpack-enabled/230500/1 "2020-04-30T08:37:33Z")

</div>

Hello Experts,

Issue : Unable to connect to elasticsearch, deployed configmap does not contain **username** : and **password** input.

Background :

I have installed Elastic search (XPACK enabled ) and kibana, this combination works fine. I was able to connect to elasticsearch from kibana using es username and password. I wanted to try out metricbeat and installed the same

Installation method: _Helm - [https://github.com/elastic/helm-charts](https://github.com/elastic/helm-charts)_

I am able to login to kibana using same user without an issue.

` helm install metricbeat elastic/metricbeat --set imageTag=7.6.2 --values metrics.yaml --namespace default`

**values**

```auto
        daemonset:
          extraEnvs:
        - name: 'ES_USERNAME'
          valueFrom:
            secretKeyRef:
              name: elastic-credentials
              key: username
        - name: 'ES_PASSWORD'
          valueFrom:
            secretKeyRef:
              name: elastic-credentials
              key: password
          # Allows you to add any config files in /usr/share/metricbeat
          # such as metricbeat.yml for daemonset
          metricbeatConfig:
        metricbeat.yml: |
          metricbeat.modules:
          - module: kubernetes
            metricsets:
              - container
              - node
              - pod
              - system
              - volume
            period: 10s
            host: "${NODE_NAME}"
            hosts: ["${NODE_NAME}:10250"]
            # bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
            # ssl.verification_mode: "none"
            # If using Red Hat OpenShift remove ssl.verification_mode entry and
            # uncomment these settings:
            #ssl.certificate_authorities:
              #- /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
            processors:
            - add_kubernetes_metadata: ~
          - module: kubernetes
            enabled: true
            metricsets:
              - event
          - module: system
            period: 10s
            metricsets:
              - cpu
              - load
              - memory
              - network
              - process
              - process_summary
            processes: ['.*']
            process.include_top_n:
              by_cpu: 5
              by_memory: 5
          - module: system
            period: 1m
            metricsets:
              - filesystem
              - fsstat
            processors:
            - drop_event.when.regexp:
                system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'
          output.elasticsearch:
            username: '${ES_USERNAME}'
            password: '${ES_PASSWORD}'
            hosts: ["elasticsearch-master:9200"]

```

```auto
        deployment:
          extraEnvs:
        - name: 'ES_USERNAME'
          valueFrom:
            secretKeyRef:
              name: elastic-credentials
              key: username
        - name: ES_PASSWORD'
          valueFrom:
            secretKeyRef:
              name: elastic-credentials
              key: password
          # Allows you to add any config files in /usr/share/metricbeat
          # such as metricbeat.yml for deployment
          metricbeatConfig:
        metricbeat.yml: |
          metricbeat.modules:
          - module: kubernetes
            enabled: true
            metricsets:
              - state_node
              - state_deployment
              - state_replicaset
              - state_pod
              - state_container
            period: 10s
            hosts: ["${KUBE_STATE_METRICS_HOSTS}"]
          output.elasticsearch:
            username: '${ES_USERNAME}'
            password: '${ES_PASSWORD}'
            hosts: ["elasticsearch-master:9200"]

```

**ERROR** `pipeline/output.go:100	Failed to connect to backoff(elasticsearch(http://elasticsearch-master:9200)): 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}`

**configmap :**

```auto
    metricbeat.modules:
    - module: kubernetes
      metricsets:
        - container
        - node
        - pod
        - system
        - volume
      period: 10s
      host: "${NODE_NAME}"
      hosts: ["${NODE_NAME}:10255"]
      processors:
      - add_kubernetes_metadata:
          in_cluster: true
    - module: kubernetes
      enabled: true
      metricsets:
        - event
    - module: system
      period: 10s
      metricsets:
        - cpu
        - load
        - memory
        - network
        - process
        - process_summary
      processes: ['.*']
      process.include_top_n:
        by_cpu: 5
        by_memory: 5
    - module: system
      period: 1m
      metricsets:
        - filesystem
        - fsstat
      processors:
      - drop_event.when.regexp:
          system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'
    output.elasticsearch:
      hosts: '${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}'

```

---

<div class="post-metadata">

**Author:** ![Julien\_MAILLERET](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julien_mailleret/32/45074_2.png) [@Julien\_MAILLERET](https://discuss.elastic.co/u/Julien_MAILLERET)\
**Post date:** [May 11, 2020, 12:40pm UTC](https://discuss.elastic.co/t/metricbeat-beat-failed-to-connect-es-xpack-enabled/230500/2 "2020-05-11T12:40:30Z")

</div>

Hi @Paul_20,

Due to a recent refactoring, the values `daemonset.xxx` and `deployment.xxx` documented on Git repository master branch aren't compatible with the current released chart version.

If you want to install the current released version ([7.6.2](https://github.com/elastic/helm-charts/releases/tag/7.6.2)), you can find the values to use on the [README from 7.6.2 release](https://github.com/elastic/helm-charts/blob/7.6.2/metricbeat/README.md#configuration).

If you want to deploy the next version which should be released in a few days and will use `daemonset.xxx` and `deployment.xxx` values, you can clone the repo and use the [installation instructions from `7.7` branch](https://github.com/elastic/helm-charts/blob/7.7/metricbeat/README.md#using-the-77-branch).

---

<div class="post-metadata">

**Author:** ![Julien\_MAILLERET](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julien_mailleret/32/45074_2.png) [@Julien\_MAILLERET](https://discuss.elastic.co/u/Julien_MAILLERET)\
**Post date:** [May 15, 2020, 12:25pm UTC](https://discuss.elastic.co/t/metricbeat-beat-failed-to-connect-es-xpack-enabled/230500/3 "2020-05-15T12:25:33Z")

</div>

FYI [7.7.0](https://github.com/elastic/helm-charts/releases/tag/7.7.0) has been released wednesday.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2020, 12:25pm UTC](https://discuss.elastic.co/t/metricbeat-beat-failed-to-connect-es-xpack-enabled/230500/4 "2020-06-12T12:25:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
