# X-Pack et logstash
**URL:** https://discuss.elastic.co/t/x-pack-et-logstash/82739
**Category:** Discussions en français
**Created:** [April 18, 2017, 3:28pm UTC](https://discuss.elastic.co/t/x-pack-et-logstash/82739 "2017-04-18T15:28:08Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@David\_ROELANDT](https://discuss.elastic.co/u/David_ROELANDT)
#### Post date: [April 18, 2017, 3:28pm UTC](https://discuss.elastic.co/t/x-pack-et-logstash/82739/1 "2017-04-18T15:28:08Z")
Bonjour,
je viens d'installer X-PACK sur un POC Elasticsuite.
Je n'arrive plus à faire communiquer logstash avec ES.
J'ai pourtant mis à jour les mots de passe pour les comptes logstash\_system, ainsi que logstash (role logstash\_writer)
Voici l'erreur que j'obtiens à la relance de logstash :
```auto
[2017-04-18T17:11:46,504][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@127.0.0.1:9200/, :path=>"/"}
[2017-04-18T17:11:46,648][WARN][logstash.outputs.elasticsearch] **Attempted to resurrect connection to dead ES instance, but got an error.** {:url=>#, :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://127.0.0.1:9200/'"}
[2017-04-18T17:11:46,649][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=>nil}
[2017-04-18T17:11:46,804][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Got response code '401' contacting Elasticsearch at URL 'http://127.0.0.1:9200/'", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError", :backtrace=>["/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:76:in `perform_request'", "/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:273:in `perform_request_to_url'", "/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:261:in `perform_request'", "/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:351:in `with_connection'", "/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:260:in `perform_request'", "/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:268:in `get'", "/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/http_client.rb:83:in `get_version'", "/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/template_manager.rb:16:in `get_es_version'", "/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/template_manager.rb:20:in `get_es_major_version'", "/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/template_manager.rb:7:in `install_template'", "/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/common.rb:54:in `install_template'", "/produit/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/common.rb:21:in `register'", "/produit/logstash/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:8:in `register'", "/produit/logstash/logstash-core/lib/logstash/output_delegator.rb:37:in `register'", "/produit/logstash/logstash-core/lib/logstash/pipeline.rb:282:in `register_plugin'", "/produit/logstash/logstash-core/lib/logstash/pipeline.rb:293:in `register_plugins'", "org/jruby/RubyArray.java:1613:in `each'", "/produit/logstash/logstash-core/lib/logstash/pipeline.rb:293:in `register_plugins'", "/produit/logstash/logstash-core/lib/logstash/pipeline.rb:302:in `start_workers'", "/produit/logstash/logstash-core/lib/logstash/pipeline.rb:232:in `run'", "/produit/logstash/logstash-core/lib/logstash/agent.rb:387:in `start_pipeline'"]}
```
Puis
```auto
[2017-04-18T16:39:57,627][ERROR][logstash.outputs.elasticsearch] Got a bad response code from server, but this code is not considered retryable. Request will be dropped {:code=>401, :response_body=>"{"error":{"root_cause":[{"type":"security_exception","reason":"failed to authenticate user [logstash_system]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security_exception","reason":"failed to authenticate user [logstash_system]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401}"}
```
J'ai testé une connexion directe : OK
```auto
curl --user logstash_system -XGET 'localhost:9200/_cluster/health'
Enter host password for user 'logstash_system':
{"cluster_name":"elasticsearch_prodj","status":"yellow","timed_out":false,"number_of_nodes":1,"number_of_data_nodes":1,"active_primary_shards":31,"active_shards":31,"relocating_shards":0,"initializing_shards":0,"unassigned_shards":30,"delayed_unassigned_shards":0,"number_of_pending_tasks":0,"number_of_in_flight_fetch":0,"task_max_waiting_in_queue_millis":0,"active_shards_percent_as_number":50.8
```
La fin de mon fichier logstash.yml :
```auto
#Fichier logstash.yml
# Security X-PACK
xpack.monitoring.elasticsearch.url: http://localhost:9200
xpack.monitoring.enabled: true # False ne marche pas mieux
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.elasticsearch.password: LE MOT DE PASSE
```
Les utilisateurs ont été créé via la console.
Est-il nécessaire de les créer en local via bin/x-pack/users ?
bref, je sèche un peu. Merci d'avance.
David
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [April 19, 2017, 6:48am UTC](https://discuss.elastic.co/t/x-pack-et-logstash/82739/2 "2017-04-19T06:48:31Z")
Tu as configuré logstash pour qu'il passe le user/password? [https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-user](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-user)
---
### Author:  [@David\_ROELANDT](https://discuss.elastic.co/u/David_ROELANDT)
#### Post date: [April 19, 2017, 7:19am UTC](https://discuss.elastic.co/t/x-pack-et-logstash/82739/3 "2017-04-19T07:19:29Z")
Bonjour,
Oui c'est configuré au niveau de chacun des output :
```auto
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "rsyslog-%{+YY.MM}"
user => "logstash_system"
password => "XXXXXXXXXXXXX"
}
```
Par contre je pense que ça se passe avant, au niveau du Healthcheck de logstash ?
Faut il créer un index .monitoring et ajouter les droits idoines pour le role logstash\_system ? (ça devrait être built-in non ?)
David
EDIT : je me relis et je me rends compte que j'ai fait une connerie. (logstash\_system n'est pas le compte censé ajouter des outputs.) Je corrige et je reviens.
---
### Author:  [@David\_ROELANDT](https://discuss.elastic.co/u/David_ROELANDT)
#### Post date: [April 19, 2017, 7:22am UTC](https://discuss.elastic.co/t/x-pack-et-logstash/82739/4 "2017-04-19T07:22:31Z")
Je pense qu'une partie de la solution se trouve ici
> [@Unable to setup authentication using x-pack](https://discuss.elastic.co/t/unable-to-setup-authentication-using-x-pack/82585/5):
>
> ./users roles adminuser -r superuser When running the roles sub-command a -r is a remove option. The command you ran remove the superuser role from adminuser. You can see the help text for by running bin/x-pack/users roles --help With respect to your other questions: No, users are only created in Elasticsearch. The other products in the Elastic Stack use Elasticsearch as their user store where applicable. However, you will need to configure those products so that they can authenticat…
Mais je ne suis pas arrivé à faire le lien :s
Avec ceci aussi :
> **[Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/index.html)**
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [April 19, 2017, 7:57am UTC](https://discuss.elastic.co/t/x-pack-et-logstash/82739/5 "2017-04-19T07:57:42Z")
Il faut utiliser le user `logstash_writer` je pense.
Je te copie un message que m'a envoyé @TimV à propos de ton post. Merci Tim !
> The problem is that he is trying to use the `logstash_system` user, but that’s not its intended purpose. The docs (in english, which is not very helpful for him) say
>
> > This user has the minimum permissions necessary for the monitoring function, and should not be used for any other purpose - it is specifically not intended for use within a Logstash pipeline.
> He’ll need to create a new `logstash_writer` user, per the top half of the documentation.
---
### Author:  [@David\_ROELANDT](https://discuss.elastic.co/u/David_ROELANDT)
#### Post date: [April 19, 2017, 8:16am UTC](https://discuss.elastic.co/t/x-pack-et-logstash/82739/6 "2017-04-19T08:16:04Z")
En fait, j'ai un compte logstash avec le role logstash\_writer. Mais les outputs étaient mal configurés.
Et j'ai été induit en erreur par le message d'erreur du début (healthcheck effectué par le compte "utilisateur" ?)
C'est tout bon. je n'ai plus d'erreurs !
Merci pour votre aide.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 17, 2017, 8:26am UTC](https://discuss.elastic.co/t/x-pack-et-logstash/82739/7 "2017-05-17T08:26:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.