# SOLVED: Logstash issue with shield - "action \[indices:data/write/bulk\] is unauthorized for user \[logstash\]"
**URL:** https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410
**Category:** Logstash
**Tags:** elastic-stack-security
**Created:** [April 26, 2016, 9:49am UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410 "2016-04-26T09:49:17Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)
#### Post date: [April 26, 2016, 9:49am UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/1 "2016-04-26T09:49:17Z")
Hi,
I am about to install shield on my cluster and when I want to configure logstash to communicate with ES i have the following problem :
- I followed the documentation and when i did this configuration the authentication didn't work:
> elasticsearch {
> ...
> user =\> "myuser"
> password =\> "mypassword"
> }
- Here is my list of users
> logstash : logstash
> kibana4-server : kibana4\_server
> rosc : kibana4
> admin : admin
I didn't touch my roles.yml file.
i have the following error in the Logstash log file:
> error\_message=\>"[403] {"error":{"root\_cause":[{"type":"security\_exception","reason":"action [indices:data/write/bulk] is unauthorized for user [logstash]"}]
Anyone have an idea ?
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [April 26, 2016, 11:17pm UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/2 "2016-04-26T23:17:53Z")
what are the indices that your logstash instance configured to write into?
---
### Author:  [@michalterbert](https://discuss.elastic.co/u/michalterbert)
#### Post date: [April 27, 2016, 6:46am UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/3 "2016-04-27T06:46:39Z")
Hi,
I You have in your roles.yml "kibana" index, please replace to "kibana\*".
Should works 🙂
---
### Author:  [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)
#### Post date: [April 27, 2016, 6:55am UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/4 "2016-04-27T06:55:43Z")
Hi jay,
My logstash is configured to write into indices "%{[@metadata][beat]}-%{+YYYY.MM.dd}", "prtsys-%{+YYYY.MM.dd}" and "logstash-%{+YYYY.MM.dd}"
Yesterday I try to assign the admin role to my logstash user, but it did not remove the error, but I now see the data appear in Kibana.
Here is my admin roles :
```
`# All operations on all indices
admin:
cluster: all
indices:
'*':
privileges: all`
```
---
### Author:  [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)
#### Post date: [April 27, 2016, 6:56am UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/5 "2016-04-27T06:56:43Z")
Hi Michal,
Do you speak of the '.kibana' ?
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [April 27, 2016, 10:18am UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/6 "2016-04-27T10:18:52Z")
Hi Clement,
That is very odd that the admin role did not allow the user to write into the indices. Do you think you could enable [auditing](https://www.elastic.co/guide/en/shield/current/configuring-auditing.html) and grab the access denied entry? This should contain more information about the failure to help diagnose it.
-Jay
---
### Author:  [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)
#### Post date: [April 27, 2016, 12:06pm UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/7 "2016-04-27T12:06:19Z")
Here are my logs in access.log file:
> [2016-04-27 13:42:13,757] [uat-node09] [transport] [access\_granted] origin\_type=[rest], origin\_address=[10.1.103.1], principal=[logstash], action=[indices:data/write/bulk[s]], indices=[logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27,logstash-2016.04.27]
> [2016-04-27 13:42:13,756] [uat-node09] [transport] [access\_granted] origin\_type=[rest], origin\_address=[10.1.103.1], principal=[logstash], action=[indices:data/write/bulk]
> [2016-04-27 13:42:13,303] [uat-node09] [transport] [access\_granted] origin\_type=[rest], origin\_address=[10.1.103.1], principal=[logstash], action=[indices:data/write/bulk[s]], indices=[topbeat-2016.04.27]
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [April 27, 2016, 12:23pm UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/8 "2016-04-27T12:23:07Z")
So there are no access denied entries and you still see that exception regarding write not being allowed for your logstash user?
---
### Author:  [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)
#### Post date: [April 27, 2016, 12:30pm UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/9 "2016-04-27T12:30:46Z")
Yes this is it,
My file logstash.log continues to fill the following logs :
> {:timestamp=\>"2016-04-27T14:25:52.328000+0200", :message=\>"Attempted to send a bulk request to Elasticsearch configured at '["[http://10.1.101.1:9200/\](http://10.1.101.1:9200/%5C)", "[http://10.1.102.1:9200/\](http://10.1.102.1:9200/%5C)", "[http://10.1.103.1:9200/\](http://10.1.103.1:9200/%5C)"]', but an error occurred and it failed! Are you sure you can reach elasticsearch from this machine using the configuration provided?", :client\_config=\>{:hosts=\>["[http://10.1.101.1:9200/](http://10.1.101.1:9200/)", "[http://10.1.102.1:9200/](http://10.1.102.1:9200/)", "[http://10.1.103.1:9200/](http://10.1.103.1:9200/)"] ...
and
> {:timestamp=\>"2016-04-27T14:25:52.328000+0200", :message=\>"[401] {"error":{"root\_cause":[{"type":"security\_exception","reason":"unable to authenticate user [logstash] for REST request [/\_bulk]","header":{"WWW-Authenticate":"Basic realm=\"shield\""}}],"type":"security\_exception","reason":"unable to authenticate user [logstash] for REST request [/\_bulk]","header":{"WWW-Authenticate":"Basic realm=\"shield\""}},"status":401}", ...
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [April 27, 2016, 12:48pm UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/10 "2016-04-27T12:48:26Z")
This appears to be a different issue. It appears as though the password may not be correct for the logstash user on this instance of logstash? I am thinking that you should see some authentication failure audit logs for that as well.
---
### Author:  [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)
#### Post date: [April 27, 2016, 2:24pm UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/11 "2016-04-27T14:24:05Z")
I test to generate this error on my other instances without success.
So i copied the logstash conf file from a good instance and it works !!!!
Thanks Jay
---
### Author:  [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)
#### Post date: [April 28, 2016, 8:45am UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/12 "2016-04-28T08:45:21Z")
This morning the errors reappeared, and they appeared on each instance.
So i try to change the password of my logstash users on each elasticsearch instance to be sure to have the same password as the one entered in the logstash conf file.
And the error still appears.
I try to restart my Elasticsearch and logstash instances but nothing changed.
And all i have in my access.log file, is access\_granted messages... ðŸ˜
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [April 28, 2016, 11:06am UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/13 "2016-04-28T11:06:34Z")
This is very odd. What versions of logstash and elasticsearch/shield are you using? The logstash user is a file based user (or esusers) correct? If so, can you validate that the user's password is the same on each node and that the roles files are in sync on each node?
---
### Author:  [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)
#### Post date: [April 28, 2016, 2:11pm UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/14 "2016-04-28T14:11:40Z")
It's my fault 😓 , logstash the user was not created on some of my two knots , I had forgotten to recreate it after deleting . Sorry about that. I will wait until tomorrow to see if no error is returned.
Thanks for your help.
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [April 28, 2016, 2:26pm UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/15 "2016-04-28T14:26:20Z")
Hopefully it does not return. You may want to consider moving to 2.3 so you can use the users API and avoid dealing with keeping these users in sync manually.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/solved-logstash-issue-with-shield-action-indices-data-write-bulk-is-unauthorized-for-user-logstash/48410/16 "2017-07-06T13:45:00Z")