User not found in cache for realm

I am trying to figure out why a native user is getting a 401 from a remote server. I have configured Filebeat to authenticate via native (the only realm I have set up), and I've created the user with a custom role (as shown below). When I try to run Filebeat on the remote server, it returns a 401 with the following errors logged in Elasticsearch:

[2017-10-26T07:54:19,831][DEBUG][o.e.x.s.a.e.ReservedRealm] [EMCTS499] user [cpe_filebeat] not found in cache for realm [reserved], proceeding with normal authentication
[2017-10-26T07:54:19,831][DEBUG][o.e.x.s.a.e.NativeRealm  ] [EMCTS499] user [cpe_filebeat] not found in cache for realm [native1], proceeding with normal authentication
[2017-10-26T07:54:19,837][DEBUG][r.suppressed             ] path: /, params: {}
org.elasticsearch.ElasticsearchSecurityException: unable to authenticate user [cpe_filebeat] for REST request [/]

However, if I make a call to the API from the host, it works without any errors. This is what I used to create the role (I use Postman, since it's hosted on a Windows box):

POST {{ES}}/_xpack/security/role/cpe_filebeat_writer
	"cluster": ["manage_index_templates", "monitor"],
	"indices": [
			"names": [ "httpderrorlog-test-*", "httplog-test-*"],
			"privileges": ["read", "write", "create_index"]

And this is the user I created:

POST {{ES}}/_xpack/security/user/cpe-filebeat
	"password" : "redacted",
	"roles" : "cpe_filebeat_writer",
	"full_name" : "Indexing Test Account",
	"enabled" : true

Here's the x-pack config from elasticsearch.yml true true [ "IP ranges go here" ] _all true "IP range goes here" _all
    type: native
    order: 0

And here's the filebeat.yml config that's running on the remote server:


- input_type: log
    - /var/log/httpd/error_log

- input_type: log
    - /usr/local/redacted/logs/HttpLog
  include_lines: ["Response"]

  hosts: ["IP with HTTP port goes here"]

  protocol: "http"
  username: "cpe_filebeat"
  password: "redacted"

  index: "httpderrorlog-test-%{+yyyy.MM.dd}"
    - index: "httplog-test-%{+yyyy.MM.dd}"
        message: "Response"

What am I missing?

Hmm in one place you use a - and a _ in the other. Is it cpe-filebeat or cpe_filebeat?

It's always a typo :-/ Thanks for catching that. It's definitely supposed to be a hyphen, not an underscore. As soon as I fixed that, everything started to flow.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.