# MongoDB Output Plugin Failed when used auth user

**URL:** <https://discuss.elastic.co/t/mongodb-output-plugin-failed-when-used-auth-user/150436>\
**Category:** Logstash\
**Created:** [September 29, 2018, 5:34pm UTC](https://discuss.elastic.co/t/mongodb-output-plugin-failed-when-used-auth-user/150436 "2018-09-29T17:34:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rahmat\_Agung\_W](https://avatars.discourse-cdn.com/v4/letter/r/c0e974/32.png) [@Rahmat\_Agung\_W](https://discuss.elastic.co/u/Rahmat_Agung_W)\
**Post date:** [September 29, 2018, 5:34pm UTC](https://discuss.elastic.co/t/mongodb-output-plugin-failed-when-used-auth-user/150436/1 "2018-09-29T17:34:15Z")

</div>

I have an logstash config like this:  
input {  
file {  
type =\> "json"  
path =\> "/home/elk/dionaea.json"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}

```
filter {
        json {
                source => "message"
        }
}

output {
        mongodb{
                collection => "attack"
                database => "dionaea"
                uri => "mongodb://admin:Maha%40siswa@10.33.109.17:27017/dionaea"
                codec => "json"
        }
        stdout {
            codec => rubydebug
        }
        }

```

But there is error when I started it.  
`[2018-09-29T17:27:20,961][WARN][logstash.outputs.mongodb] Failed to send event to MongoDB {:event=>#<LogStash::Event:0x5ee0398c>, :exception=>#<Mongo::Error::OperationFailure: not authorized on dionaea to execute command { insert: "attack", documents: [{ @timestamp: ""2018-09-29T17:26:40.573Z"", src_ip: "146.185.222.35", @version: "1", dst_port: 40628, path: "/home/elk/dionaea.json", src_hostname: "", connection: { type: "reject", transport: "tcp", protocol: "pcap" }, dst_ip: "192.168.100.79", type: "json", message: "{"dst_port": 40628, "src_hostname": "", "src_port": 58072, "timestamp": "2018-09-23T11:37:35.132585", "connection": {"type": "reject", "protocol": "pc...", host: "dataServer", timestamp: "2018-09-23T11:37:35.132585", src_port: 58072, _id: ObjectId('5bafb5f8860afa5f8b00000e') }], writeConcern: { w: 1 }, ordered: true } (13)>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/mongo-2.0.6/lib/mongo/operation/result.rb:214:in`validate!'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/mongo-2.0.6/lib/mongo/operation/write/insert.rb:72:in `execute_write_command'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/mongo-2.0.6/lib/mongo/operation/write/insert.rb:62:in`execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/mongo-2.0.6/lib/mongo/collection.rb:190:in `insert_many'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/mongo-2.0.6/lib/mongo/collection.rb:175:in`insert\_one'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-mongodb-3.1.4/lib/logstash/outputs/mongodb.rb:100:in `receive'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:89:in`block in multi\_receive'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:89:in`multi\_receive'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:114:in `multi_receive'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:97:in`multi\_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:372:in `block in output_batch'", "org/jruby/RubyHash.java:1343:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:371:in `output_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:323:in`worker\_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:285:in `block in start_workers'"]}`  
It only happened when I use authentication on my mongo user.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 27, 2018, 5:34pm UTC](https://discuss.elastic.co/t/mongodb-output-plugin-failed-when-used-auth-user/150436/2 "2018-10-27T17:34:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.