Unable to launch logstash and ingest data - Got response code '401' contacting Elasticsearch at URL 'http://localhost:9200/_xpack'

Hi team,

Let me provide a short background to this - I was able to successfully ingest data to the engine using logstash. It is only after installing x-pack that I run into the following error stack upon passing the following command for ingesting data - logstash -f "sys address of the config file".

[2018-06-05T11:00:06,853][WARN ][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://logstash:xxxxxx@localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://localhost:9200/'"}
Got response code '401' contacting Elasticsearch at URL 'http://localhost:9200/_xpack'
[2018-06-05T11:00:06,964][ERROR][logstash.licensechecker.licensemanager] Unable to retrieve license information from license server {:message=>"Got response code '401' contacting Elasticsearch at URL 'http://localhost:9200/_xpack'", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError"}
[2018-06-05T11:00:06,969][WARN ][logstash.licensechecker.xpackinfo] Nil response from License Server
[2018-06-05T11:00:07,089][INFO ][logstash.pipeline ] Pipeline started successfully {:pipeline_id=>".monitoring-logstash", :thread=>"#<Thread:0x7c4255e9 run>"}
[2018-06-05T11:00:07,196][INFO ][logstash.agent ] Pipelines running {:count=>1, :pipelines=>[".monitoring-logstash"]}
[2018-06-05T11:00:07,214][ERROR][logstash.inputs.metrics ] Monitoring is not available: License information is currently unavailable. Please make sure you have added your production elasticsearch connection info in the xpack.monitoring.elasticsearch settings.
[2018-06-05T11:00:08,688][INFO ][logstash.pipeline ] Pipeline has terminated {:pipeline_id=>".monitoring-logstash", :thread=>"#<Thread:0x7c4255e9 run>"}

Further, I assume it is some kind of connection/auth issues.

Request you to help me identify the fix.

Thanks in advance.

Can we have your elasticsearch and logstash yml settings?

Hi,

I haven't changed any of the elasticsearch.yml settings. It is unedited.

Just added the following to logstash.yml -

xpack.monitoring.elasticsearch.username: "logstash"
xpack.monitoring.elasticsearch.password: "6PkpVXNoAFD0EyD6cHT0"
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.url: "http://localhost:9200"
xpack.management.elasticsearch.url: "http://localhost:9200"

And the following to kibana.yml. (I am successfully able to launch kibana post xpack installation) -

elasticsearch.url: "http://localhost:9200"
elasticsearch.username: "kibana"
elasticsearch.password: "RWRRVobuxYGYBZgISypa"

Kindly help me fix this. Let me know in case you need further info from my end.

Thanks in advance.

I think its authentication issue. Could you try comment out or remove this line in logstash.yml

xpack.monitoring.elasticsearch.username: "logstash"
xpack.monitoring.elasticsearch.password: "6PkpVXNoAFD0EyD6cHT0"

Hi,

I did commented out the 2 lines in my logstash.yml. Didn't work for me. Kindly request your attention on this.

Thanks in advance.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.