logstash Authentication error with shield

Question

I'm getting the following error while trying to output data to elasticsearch from logstash:

Failed to install template: [401] {"error":"AuthenticationException[unable to authenticate user [es_admin] for REST request [/_template/logstash]]","status":401} {:level=>:error}

I have the configuration like this in logstash:

if [type]=="signup"{
            elasticsearch {
                    protocol => "http"
                    user =>"*****"
                    password =>"*******"
                    document_type => "signup"
                    host => "localhost"
                    index => "signups"
            }
    }

I have tried adding user with following commands:

esusers useradd <username> -p <password> -r logstash

I also tried giving role admin but logstash not working for admin user also. The localhost:9200 is asking for the password and after entering the password it works but the logstash is giving an error.

score 0 · Answer 1 · answered Oct 29 '15 at 17:42

I also had similar issue. There is a known issue with elasticsearch if the password has an "@" symbol, this issue can happen. See below link:

https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/232

Also some documentation on elasticsearch has instructions to include "shield" configuration in elasticsearch.yml, but if you have only one shield realm, this is not needed. I dont have shield configuration in elasticsearch.yml

score 0 · Answer 2 · answered Dec 27 '15 at 00:17

I see that you tried with both logstash and admin user but failed.

To try with an admin privileged user:

Please make sure your /etc/elasticsearch/shield/roles.yml has below content for admin role:

# All cluster rights
# All operations on all indices
admin:
  cluster: all
  indices:
    '*':
      privileges: all

Then test something like below:

curl -u es_admin:es_admin_password localhost:9200/_cat/health

To make the logstash role user to work, logstash role need to be tweaked at roles.yml. I configured logstash to use admin privileged user to write to elasticsearch. I hope this would help.

logstash Authentication error with shield

2 Answers2