# Logstash indexer not updating elasticsearch with search-guard enabled

**URL:** <https://forum.search-guard.com/t/logstash-indexer-not-updating-elasticsearch-with-search-guard-enabled/134>\
**Category:** Search Guard\
**Created:** [March 17, 2016, 7:35pm UTC](https://forum.search-guard.com/t/logstash-indexer-not-updating-elasticsearch-with-search-guard-enabled/134 "2016-03-17T19:35:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cds\_Support](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Cds\_Support](https://forum.search-guard.com/u/Cds_Support)\
**Post date:** [March 17, 2016, 7:35pm UTC](https://forum.search-guard.com/t/logstash-indexer-not-updating-elasticsearch-with-search-guard-enabled/134/1 "2016-03-17T19:35:23Z")

</div>

Hello,

I’m running these versions for our two node (server) ELK stack on CentOS 6.7.

Logstash 1.5.3

Elasticsearch 1.7.1

Kibana 4.0.1

Redis 2.8.6

search-guard 1.7.3.0

I installed bin/plugin -i com.floragunn/search-guard/1.7.3.0. Then configured the elasticsearch.yml, kibana.yml and the authentication works where I can log into elasticsearch and kibana. I’m using just the basic authentication setup in the [https://github.com/floragunncom/search-guard/blob/master/searchguard\_config\_example\_1.yml](https://github.com/floragunncom/search-guard/blob/master/searchguard_config_example_1.yml) example to see if I can get it working.

My issue is that the Logstash indexer isn’t updating elasticsearch. I tried this in the indexer.conf file and the log says “Error: User and password parameters are not supported for ‘node’. Change the protocol to ‘http’ if you need them.”

output {

elasticsearch {

cluster =\> “elasticsearch\_preprod”

user =\> “admin”

password =\> “secret”

}

}

Then I tried with this configuration below and I get {:timestamp=\>“2016-03-17T14:20:36.798000-0500”, :message=\>“Unknown setting ‘cluster’ for elasticsearch\_http”, :level=\>:error}.

output {

elasticsearch\_http {

cluster =\> “elasticsearch\_preprod”

user =\> “admin”

password =\> “secret”

}

}

Then I tried with this configuration below and I get {:timestamp=\>“2016-03-17T14:24:00.313000-0500”, :message=\>“Invalid setting for elasticsearch\_http output plugin:\n\n output {\n elasticsearch\_http {\n # This setting must be a string\n # Expected string, got ["172.26.2.209:9200", "172.26.2.240:9200"]\n host =\> ["172.26.2.209:9200", "172.26.2.240:9200"]\n …\n }\n }”, :level=\>:error}

output {

elasticsearch\_http {

host =\> [“172.26.2.209:9200”, “172.26.2.240:9200”]

user =\> “admin”

password =\> “secret”

}

}

Then I tried with this configuration below and I get {:timestamp=\>“2016-03-17T14:25:04.250000-0500”, :message=\>“Unknown setting ‘hosts’ for elasticsearch\_http”, :level=\>:error}

output {

elasticsearch\_http {

hosts =\> [“172.26.2.209:9200”, “172.26.2.240:9200”]

user =\> “admin”

password =\> “secret”

}

}

So I’m looking for suggestions on how to configure so the indexer will update elasticsearch in my cluster. Thank you.

---

<div class="post-metadata">

**Author:** ![Cds\_Support](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Cds\_Support](https://forum.search-guard.com/u/Cds_Support)\
**Post date:** [March 18, 2016, 7:33pm UTC](https://forum.search-guard.com/t/logstash-indexer-not-updating-elasticsearch-with-search-guard-enabled/134/2 "2016-03-18T19:33:46Z")

</div>

I figured it out. Below is what was needed for the indexer to connect with the example I originally provided.

output {

elasticsearch {

protocol =\> http

cluster =\> “elasticsearch\_prod”

user =\> admin

password =\> secret

}

}

> **···**
>
> On Thursday, March 17, 2016 at 2:35:23 PM UTC-5, Cds Support wrote:
> 
> > Hello,
> 
> > 
> 
> > I’m running these versions for our two node (server) ELK stack on CentOS 6.7.
> 
> > 
> 
> > Logstash 1.5.3
> 
> > Elasticsearch 1.7.1
> 
> > Kibana 4.0.1
> 
> > Redis 2.8.6
> 
> > search-guard 1.7.3.0
> 
> > 
> 
> > I installed bin/plugin -i com.floragunn/search-guard/[1.7.3.0](http://1.7.3.0). Then configured the elasticsearch.yml, kibana.yml and the authentication works where I can log into elasticsearch and kibana. I’m using just the basic authentication setup in the [https://github.com/floragunncom/search-guard/blob/master/searchguard\_config\_example\_1.yml](https://github.com/floragunncom/search-guard/blob/master/searchguard_config_example_1.yml) example to see if I can get it working.
> 
> > 
> 
> > My issue is that the Logstash indexer isn’t updating elasticsearch. I tried this in the indexer.conf file and the log says “Error: User and password parameters are not supported for ‘node’. Change the protocol to ‘http’ if you need them.”
> 
> > 
> 
> > output {
> 
> > 
> 
> > elasticsearch {
> 
> > cluster =\> “elasticsearch\_preprod”
> 
> > user =\> “admin”
> 
> > password =\> “secret”
> 
> > }
> 
> > }
> 
> > 
> 
> > Then I tried with this configuration below and I get {:timestamp=\>“2016-03-17T14:20:36.798000-0500”, :message=\>“Unknown setting ‘cluster’ for elasticsearch\_http”, :level=\>:error}.
> 
> > 
> 
> > output {
> 
> > 
> 
> > elasticsearch\_http {
> 
> > cluster =\> “elasticsearch\_preprod”
> 
> > user =\> “admin”
> 
> > password =\> “secret”
> 
> > }
> 
> > }
> 
> > 
> 
> > Then I tried with this configuration below and I get {:timestamp=\>“2016-03-17T14:24:00.313000-0500”, :message=\>“Invalid setting for elasticsearch\_http output plugin:\n\n output {\n elasticsearch\_http {\n # This setting must be a string\n # Expected string, got ["[172.26.2.209:9200](http://172.26.2.209:9200)", "[172.26.2.240:9200](http://172.26.2.240:9200)"]\n host =\> ["[172.26.2.209:9200](http://172.26.2.209:9200)", "[172.26.2.240:9200](http://172.26.2.240:9200)"]\n …\n }\n }”, :level=\>:error}
> 
> > 
> 
> > output {
> 
> > 
> 
> > elasticsearch\_http {
> 
> > host =\> [“[172.26.2.209:9200](http://172.26.2.209:9200)”, “[172.26.2.240:9200](http://172.26.2.240:9200)”]
> 
> > user =\> “admin”
> 
> > password =\> “secret”
> 
> > }
> 
> > }
> 
> > 
> 
> > Then I tried with this configuration below and I get {:timestamp=\>“2016-03-17T14:25:04.250000-0500”, :message=\>“Unknown setting ‘hosts’ for elasticsearch\_http”, :level=\>:error}
> 
> > 
> 
> > output {
> 
> > 
> 
> > elasticsearch\_http {
> 
> > hosts =\> [“[172.26.2.209:9200](http://172.26.2.209:9200)”, “[172.26.2.240:9200](http://172.26.2.240:9200)”]
> 
> > user =\> “admin”
> 
> > password =\> “secret”
> 
> > }
> 
> > }
> 
> > 
> 
> > 
> 
> > So I’m looking for suggestions on how to configure so the indexer will update elasticsearch in my cluster. Thank you.
> 
> >