# What could be the problem here trying to connect logstash to ElasticSearch 7.5 for the first time? **URL:** \ **Category:** Logstash\ **Created:** [November 18, 2024, 6:13pm UTC](https://discuss.elastic.co/t/what-could-be-the-problem-here-trying-to-connect-logstash-to-elasticsearch-7-5-for-the-first-time/370714 "2024-11-18T18:13:50Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![mpniel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mpniel/32/113170_2.png) [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Post date:** [November 18, 2024, 6:13pm UTC](https://discuss.elastic.co/t/what-could-be-the-problem-here-trying-to-connect-logstash-to-elasticsearch-7-5-for-the-first-time/370714/1 "2024-11-18T18:13:50Z")
What could be the problem here trying to connect logstash to Elasticsearch 7.5 for the first time? Nov 18 11:55:34 srLogStash001 run\_tviLogStash.sh[98904]: [2024-11-18T11:55:34,362][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://UA16:xxxxxx@elagen.prod.tech.dom:9200/](http://UA16:xxxxxx@elagen.prod.tech.dom:9200/)", :erro r\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elastics earch at URL '[http://elagen.prod.tech.dom:9200/](http://elagen.prod.tech.dom:9200/)'"} ---
**Author:** ![Alex\_Salgado-Elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_salgado-elastic/32/103081_2.png) [@Alex\_Salgado-Elastic](https://discuss.elastic.co/u/Alex_Salgado-Elastic)\ **Post date:** [November 18, 2024, 6:19pm UTC](https://discuss.elastic.co/t/what-could-be-the-problem-here-trying-to-connect-logstash-to-elasticsearch-7-5-for-the-first-time/370714/2 "2024-11-18T18:19:52Z")
Hi @mpniel From the 401 error (code 40 in the log), it seems to be an authentication issue when trying to connect to Elasticsearch. Let's check some possible causes: Make sure the username (UA16) and password are correct. ---
**Author:** ![mpniel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mpniel/32/113170_2.png) [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Post date:** [November 18, 2024, 6:25pm UTC](https://discuss.elastic.co/t/what-could-be-the-problem-here-trying-to-connect-logstash-to-elasticsearch-7-5-for-the-first-time/370714/3 "2024-11-18T18:25:27Z")
Hi username password are correct ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 18, 2024, 6:28pm UTC](https://discuss.elastic.co/t/what-could-be-the-problem-here-trying-to-connect-logstash-to-elasticsearch-7-5-for-the-first-time/370714/4 "2024-11-18T18:28:53Z")
> [@mpniel](#): > > username password are correct Not according to Elasticsearch. 401 means that Elasticsearch is receiving a wrong username or password, you need to validate that. Try to make a curl request from the Logstash machine using the username and password that are configured in the output. ---
**Author:** ![mpniel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mpniel/32/113170_2.png) [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Post date:** [November 18, 2024, 7:31pm UTC](https://discuss.elastic.co/t/what-could-be-the-problem-here-trying-to-connect-logstash-to-elasticsearch-7-5-for-the-first-time/370714/5 "2024-11-18T19:31:07Z")
The dev team say they send the correct password. Any other idea? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 18, 2024, 7:37pm UTC](https://discuss.elastic.co/t/what-could-be-the-problem-here-trying-to-connect-logstash-to-elasticsearch-7-5-for-the-first-time/370714/6 "2024-11-18T19:37:36Z")
No, the error is pretty clear. > "Got response code ' **401**' contacting Elastics earch at URL An HTTP 401 error code means that the request was Unauthorized, the user or password used is not correct. You need to double check it and validate, something is not correct. ---
**Author:** ![mpniel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mpniel/32/113170_2.png) [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Post date:** [November 18, 2024, 8:59pm UTC](https://discuss.elastic.co/t/what-could-be-the-problem-here-trying-to-connect-logstash-to-elasticsearch-7-5-for-the-first-time/370714/7 "2024-11-18T20:59:27Z")
We use ROR ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 18, 2024, 9:56pm UTC](https://discuss.elastic.co/t/what-could-be-the-problem-here-trying-to-connect-logstash-to-elasticsearch-7-5-for-the-first-time/370714/8 "2024-11-18T21:56:50Z")
> [@mpniel](#): > > We use ROR I have no idea what you mean with that. What is ROR? ---
**Author:** ![mpniel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mpniel/32/113170_2.png) [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Post date:** [November 19, 2024, 8:19am UTC](https://discuss.elastic.co/t/what-could-be-the-problem-here-trying-to-connect-logstash-to-elasticsearch-7-5-for-the-first-time/370714/9 "2024-11-19T08:19:42Z")
ReadonlyREST > **[For Elasticsearch | ReadonlyREST](https://docs.readonlyrest.com/elasticsearch)** ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 19, 2024, 12:41pm UTC](https://discuss.elastic.co/t/what-could-be-the-problem-here-trying-to-connect-logstash-to-elasticsearch-7-5-for-the-first-time/370714/10 "2024-11-19T12:41:22Z")
ReadonlyREST is not an Elastic product and it is not supported here. But as mentioned, a 401 error means that the request was unauthorized, the username or password is wrong. There is not much with we can help you here.