# X-pack on logstash
**URL:** https://discuss.elastic.co/t/x-pack-on-logstash/114108
**Category:** Logstash
**Created:** [January 4, 2018, 2:16pm UTC](https://discuss.elastic.co/t/x-pack-on-logstash/114108 "2018-01-04T14:16:28Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@SJN8](https://discuss.elastic.co/u/SJN8)
#### Post date: [January 4, 2018, 2:16pm UTC](https://discuss.elastic.co/t/x-pack-on-logstash/114108/1 "2018-01-04T14:16:29Z")
Hi All ,
I have installed X-pack on logstash but in step it is mentioned to add user and pwd in logstash.yml .
but i am using pipelines which have configuration files under conf.d ,
so where shall i add x-pack related settings .
Update Logstash to use the new password for the built-in logstash\_system user, which you set up along with the other built-in users when you installed X-Pack on Elasticsearch. You must configure the xpack.monitoring.elasticsearch.password setting in the logstash.yml configuration file with the new password for the logstash\_system user.
xpack.monitoring.elasticsearch.username: logstash\_system
xpack.monitoring.elasticsearch.password: logstashpassword
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 4, 2018, 10:10pm UTC](https://discuss.elastic.co/t/x-pack-on-logstash/114108/2 "2018-01-04T22:10:20Z")
> [@SJN8](#):
>
> xpack.monitoring.elasticsearch.username: logstash\_system
>
> xpack.monitoring.elasticsearch.password: logstashpassword
Those two go in `logstash.yml`
---
### Author:  [@SJN8](https://discuss.elastic.co/u/SJN8)
#### Post date: [January 5, 2018, 6:45am UTC](https://discuss.elastic.co/t/x-pack-on-logstash/114108/3 "2018-01-05T06:45:20Z")
Yup i have updated these details in logstash.yml also below settings also ,
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.url: ["[http://node01:9200](http://node01:9200)","[http://node02:9200](http://node02:9200)","[http://node03:9200](http://node03:9200)"]
xpack.monitoring.elasticsearch.username: logstash\_system
xpack.monitoring.elasticsearch.password: XXXXXXXXXX
but i am seeing below exception while starting logstash ,
[2018-01-05T00:00:04,329][WARN][logstash.outputs.elasticsearch] You are using a deprecated config setting "document\_type" set in
elasticsearch. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Document type
s are being deprecated in Elasticsearch 6.0, and removed entirely in 7.0. You should avoid this feature If you have any questions
about this, please visit the #logstash channel on freenode irc. {:name=\>"document\_type", :plugin=\>\[[http://vielk01dsy.dsone.3ds.com:9200](http://vielk01dsy.dsone.3ds.com:9200), [http://vielk02dsy.dsone.3ds.com:9200](http://vielk02dsy.dsone.3ds.com:9200), [http://vpkiba1dsy.dsone.3ds.com:9200](http://vpkiba1dsy.dsone.3ds.com:9200)], bulk\_
path=\>"/\_xpack/monitoring/\_bulk?system\_id=logstash&system\_api\_version=2&interval=1s", manage\_template=\>false, document\_type=\>"%{[@
metadata][document\_type]}", sniffing=\>false, user=\>"logstash\_system", password=\>, id=\>"e2ff6781ffaafd4b5fe25b53c84ba2f89
d28fd61c871ada00b153a1f3a3fbe7d", enable\_metric=\>true, codec=\>\"plain\_582aa62d-0178-4f91-b184-1e70cb03
f84a", enable\_metric=\>true, charset=\>"UTF-8"\>, workers=\>1, template\_name=\>"logstash", template\_overwrite=\>false, doc\_as\_upsert=\>fa
lse, script\_type=\>"inline", script\_lang=\>"painless", script\_var\_name=\>"event", scripted\_upsert=\>false, retry\_initial\_interval=\>2,
retry\_max\_interval=\>64, retry\_on\_conflict=\>1, action=\>"index", ssl\_certificate\_verification=\>true, sniffing\_delay=\>5, timeout=\>60,
pool\_max=\>1000, pool\_max\_per\_route=\>100, resurrect\_delay=\>5, validate\_after\_inactivity=\>10000, http\_compression=\>false\>}
[2018-01-05T00:00:04,577][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=
> [[http://logstash\_system:xxxxxx@vielk01dsy.dsone.3ds.com:9200/](http://logstash_system:xxxxxx@vielk01dsy.dsone.3ds.com:9200/), [http://logstash\_system:xxxxxx@vielk02dsy.dsone.3ds.com:9200/](http://logstash_system:xxxxxx@vielk02dsy.dsone.3ds.com:9200/), http
> ://logstash\_system:xxxxxx@vpkiba1dsy.dsone.3ds.com:9200/]}}
[2018-01-05T00:00:04,729][WARN][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be
used to determine the document \_type {:es\_version=\>6}
[2018-01-05T00:00:04,751][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>".monitoring-logstash", "pipeline.wor
kers"=\>1, "pipeline.batch.size"=\>2, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>2, :thread=\>"#\"}
[2018-01-05T00:00:06,371][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error.
{:url=\>"[http://vielk01dsy.dsone.3ds.com:9200/](http://vielk01dsy.dsone.3ds.com:9200/)", :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError,
:error=\>"Got response code '401' contacting Elasticsearch at URL '[http://vielk01dsy.dsone.3ds.com:9200/](http://vielk01dsy.dsone.3ds.com:9200/)'"}
[2018-01-05T00:00:06,379][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error.
{:url=\>"[http://vielk02dsy.dsone.3ds.com:9200/](http://vielk02dsy.dsone.3ds.com:9200/)", :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError,
:error=\>"Got response code '401' contacting Elasticsearch at URL '[http://vielk02dsy.dsone.3ds.com:9200/](http://vielk02dsy.dsone.3ds.com:9200/)'"}
[2018-01-05T00:00:06,392][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error.
{:url=\>"[http://vpkiba1dsy.dsone.3ds.com:9200/](http://vpkiba1dsy.dsone.3ds.com:9200/)", :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError,
:error=\>"Got response code '401' contacting Elasticsearch at URL '[http://vpkiba1dsy.dsone.3ds.com:9200/](http://vpkiba1dsy.dsone.3ds.com:9200/)'"}
[2018-01-05T00:00:06,392][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}
---
### Author:  [@SJN8](https://discuss.elastic.co/u/SJN8)
#### Post date: [January 5, 2018, 6:46am UTC](https://discuss.elastic.co/t/x-pack-on-logstash/114108/4 "2018-01-05T06:46:38Z")
exception continued ,
[2018-01-05T00:00:06,394][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=\>"Template file '' could not be found!",
:class=\>"ArgumentError",
:backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/
lib/logstash/outputs/elasticsearch/template\_manager.rb:31:
in `read_template_file'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/ lib/logstash/outputs/elasticsearch/template_manager.rb:17: in`get\_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/
logstash-output-elasticsearch-9.0.2-java/lib/logstash/outputs/elasticsearch/template\_manager.rb:7
:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/lib/logstash/outputs/ elasticsearch/common.rb:57:in`install\_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/lib/
logstash/outputs/elasticsearch/common.rb:26:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:9:in`register'", "/usr/share/logstash/logstash-core/lib/logstash/output\_delegator.rb:43:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:343:in`register\_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:354:in
`block in register_plugins'", "org/jruby/RubyArray.java:1734:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:354:in
`register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:743: in`maybe\_setup\_out\_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:364
:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:288: in`run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:248:in `block in start'"]}
what template it is talking about and trying to load .
aslo my ES nodes are running fine but i am not able to see any data in indexes .
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 5, 2018, 7:39pm UTC](https://discuss.elastic.co/t/x-pack-on-logstash/114108/5 "2018-01-05T19:39:23Z")
401 indicates an authentication problem, so I would check the user against the cluster manually.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 2, 2018, 7:39pm UTC](https://discuss.elastic.co/t/x-pack-on-logstash/114108/6 "2018-02-02T19:39:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.