Missing authentication token MetricBeat

helo, i have an issue with metricbeat.
before i install xpack, metricbeat running very well.

but suddenly after i install xpack, i cant access it from my kibana.
i run this command in my terminal :
curl -XGET 'http://localhost:9200/metricbeat-*/_search?pretty'

but i got this error msg

missing authentication token for REST request [/metricbeat-*/_search?pretty]

i already changed my metricbeat.yml

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  username: "elastic"
  password: "techno2013"

#output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5044"]

but i still got the same error msg.
pls guys help me out.

thank you.

Can you curl ES with those auth details successfully?

yes sir. idk what happen. is there something wrong with config file?

I assume you redirect your metricbeat to logstash. Do you have set credentials in logstash?

what do you mean?
i already open logstash.yml
as long as i know, there is no place to set credential there.

pls correct me if im wrong.

thanks.

See here

im quite confuse since the docs is for the old version of shield.

By default, the Shield plugin installs a dedicated user role that enables the creation of indices with names that match the logstash-* regular expression, along with privileges to read, index, update, and delete documents in those indices:

logstash:
cluster:
- manage_index_templates
indices:
- names: 'logstash-*'
privileges:
- write
- read
- create_index

what is that mean?
where i can find shield config file?
can you help me.

I mean the part Basic Authentication. See here. Did you try with user and password?

yes im using username and password.

I'm not so familiar with logstash and XPack. But it seems more a failure of the combination of logstash and elastic/xpack. Can you please post this question in the logstash forum. Thanks!!

thank you for the suggestion.
means alot.

i will repost this question to logstash forum.

thanks.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.