# Security index error - everything working fine

**URL:** <https://discuss.elastic.co/t/security-index-error-everything-working-fine/218046>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [February 5, 2020, 6:33pm UTC](https://discuss.elastic.co/t/security-index-error-everything-working-fine/218046 "2020-02-05T18:33:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sergio\_Peral\_Aguiler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sergio_peral_aguiler/32/45999_2.png) [@Sergio\_Peral\_Aguiler](https://discuss.elastic.co/u/Sergio_Peral_Aguiler)\
**Post date:** [February 5, 2020, 6:33pm UTC](https://discuss.elastic.co/t/security-index-error-everything-working-fine/218046/1 "2020-02-05T18:33:10Z")

</div>

Hi all,  
Recently I moved the **path.data** to a different folder, keeping permissions and everything, changing the option in **elasticsearch.yml** and it worked as expected and everything working fine.  
However, in the Elasticsearch logs, I can see the following error:  
**[2020-02-04T19:38:38,109][ERROR][o.e.x.s.a.e.ReservedRealm] [node-1] failed to retrieve password hash for reserved user [elastic]**  
**org.elasticsearch.action.UnavailableShardsException: at least one primary shard for the index [.security-7] is unavailable**

I checked that **.security-7** index has only one primary shard and its state is STARTED. Moreover, my Filebeat and Kibana are using credentials to connect to Elasticsearch and are working fine. It's only one Elasticsearch node.

I'm just curious about what can be going wrong with that index. Someone can explain?

Thank you so much.

Best regards,  
Sergio.

---

<div class="post-metadata">

**Author:** ![wifi](https://avatars.discourse-cdn.com/v4/letter/w/f05b48/32.png) [@wifi](https://discuss.elastic.co/u/wifi)\
**Post date:** [February 12, 2020, 3:49pm UTC](https://discuss.elastic.co/t/security-index-error-everything-working-fine/218046/2 "2020-02-12T15:49:01Z")

</div>

When i try to do a rolling restart and perform some rest calls in between the restart of two nodes the rest calls fail due to an authentication failure. Checking the logs i receive the same errors as you do. I guess that elasticsearch takes some time to get the authentication running, might also be a bug which causes the first authentication attempt to fail

---

<div class="post-metadata">

**Author:** ![Sergio\_Peral\_Aguiler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sergio_peral_aguiler/32/45999_2.png) [@Sergio\_Peral\_Aguiler](https://discuss.elastic.co/u/Sergio_Peral_Aguiler)\
**Post date:** [February 12, 2020, 7:26pm UTC](https://discuss.elastic.co/t/security-index-error-everything-working-fine/218046/3 "2020-02-12T19:26:07Z")

</div>

It is weird because everything works well, I can perform API calls authenticating myself, but I still have those logs ☹

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2020, 7:26pm UTC](https://discuss.elastic.co/t/security-index-error-everything-working-fine/218046/4 "2020-03-11T19:26:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.