Got response code ‘403’ contacting Elasticsearch at URL

ERROR Code

[ERROR] [logstash.outputs.elasticsearch] Elasticsearch setup did not complete normally, please review previously errors { :message=> Got response code ‘403’ contacting Elasticsearch at URL ‘localhost:9200/_ilm/ilmpolicy1’} :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError

Solution

If you get this error when try to send data from logstash to elasticsearch; you should check user permissions. Probably user needs more privilege and it depends on what you are trying to do. For Example I try to manage ilm policy with logstash pipeline.conf. My sample pipeline.conf shown as below. User needs to auto_configure, create_index, manage_all index privileges and manage_ilm cluster privilege for this purpose. This pipeline include rollover and ILM configurations.

output {
ilm_rollover_alias => “sampleindex”
ilm_pattern =>”{now/d}-000001″
ilm_policy=>”policy1″
user=>”sampleuser1″
password=>”password123″
}