# Need help with 403 errors Logstash 6.2.4 with X-Pack **URL:** \ **Category:** Logstash\ **Created:** [May 22, 2018, 6:41pm UTC](https://discuss.elastic.co/t/need-help-with-403-errors-logstash-6-2-4-with-x-pack/132876 "2018-05-22T18:41:08Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jn1965](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jn1965](https://discuss.elastic.co/u/jn1965)\ **Post date:** [May 22, 2018, 6:41pm UTC](https://discuss.elastic.co/t/need-help-with-403-errors-logstash-6-2-4-with-x-pack/132876/1 "2018-05-22T18:41:08Z")
Everythign was working fine until I installed X-Pack on a remote logstash server. Now I am geting this error: [2018-05-22T18:30:12,500][ERROR][logstash.config.sourceloader] Could not fetch all the sources {:exception=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=\>"Got response code '403' contacting Elasticsearch at URL '[http://IPADDRES:9200/.logstash/doc/\_mget](http://IPADDRES:9200/.logstash/doc/_mget)'", :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client/manticore\_adapter.rb:80:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in`perform\_request\_to\_url'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:278:in `block in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:373:in`with\_connection'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:277:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285:in`block in post'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client.rb:166:in `post'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/x-pack-6.2.4-java/lib/config_management/elasticsearch_source.rb:127:in`fetch\_config'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/x-pack-6.2.4-java/lib/config\_management/elasticsearch\_source.rb:73:in `pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:59:in`block in fetch'", "org/jruby/RubyArray.java:2481:in `collect'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:58:in`fetch'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:148:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:105:in`block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/interval.rb:18:in `interval'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:94:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in`block in initialize'"]} I have set up the passwords for logstash\_system and elastic and put them in logstash.yml like this: xpack.monitoring.elasticsearch.username: logstash\_system xpack.monitoring.elasticsearch.password: PASSWORD xpack.management.elasticsearch.username: logstash\_system xpack.management.elasticsearch.password: PASSWORD xpack.monitoring.elasticsearch.url: "[http://IPADDRFESS:9200](http://IPADDRFESS:9200)" xpack.management.enabled: true xpack.management.elasticsearch.url: "[http://IPADDRESS:9200](http://IPADDRESS:9200)" in my syslog.conf file i added this: output { elasticsearch { hosts =\> ["IPADDRESS"] manage\_template =\> false index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" user =\> "elastic" password =\> PASSWORD!" } If I go to the URL I get this in Chrome once I log in as logstash\_system: { "name" : "node-name", "cluster\_name" : "elasticsearch", "cluster\_uuid" : "bunch of stuff", "version" : { "number" : "6.2.4", "build\_hash" : "ccec39f", "build\_date" : "2018-04-12T20:37:28.497551Z", "build\_snapshot" : false, "lucene\_version" : "7.2.1", "minimum\_wire\_compatibility\_version" : "5.6.0", "minimum\_index\_compatibility\_version" : "5.0.0" }, "tagline" : "You Know, for Search" I have been looking and have not found this error... Can soembody let me know how to get this working? Thanks!! ---
**Author:** ![jn1965](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jn1965](https://discuss.elastic.co/u/jn1965)\ **Post date:** [May 24, 2018, 7:29pm UTC](https://discuss.elastic.co/t/need-help-with-403-errors-logstash-6-2-4-with-x-pack/132876/2 "2018-05-24T19:29:54Z")
Nver mind, blew away logstash and reinstalled it then did the x\_pack install again and it worked ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 21, 2018, 7:29pm UTC](https://discuss.elastic.co/t/need-help-with-403-errors-logstash-6-2-4-with-x-pack/132876/3 "2018-06-21T19:29:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.