Hi,
Actually I broke everything so I made a new clean install and I found the culprit. I read the logs and the doc and I found that this line was wrong “kibana_access: ro+”. It’s now "“kibana_access: ro”.
Now I have this different error with a 401 error in logstash.
[WARN ] 2019-01-08 08:25:08.351 [Ruby-0-Thread-12: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://logstash:xxxxxx@localhost:9200/", error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://localhost:9200/'"}`
I think these are the lines related to the logstash error in elasticsearch.log because they only appear if I run logstash :
[2019-01-08T09:07:33,463][INFO ][t.b.r.a.ACL ] [jgeVQ7z] FORBIDDEN by default req={ ID:1341788589-2099370580#22988, TYP:MainRequest, CGR:N/A, USR:logstash(?), BRS:true, KDX:null, ACT:cluster:monitor/main, OA:127.0.0.1, DA:127.0.0.1, IDX:<N/A>, MET:HEAD, PTH:/, CNT:<N/A>, HDR:{Authorization=<OMITTED>, content-length=0, Connection=Keep-Alive, User-Agent=Manticore 0.6.4, Host=localhost:9200, Accept-Encoding=gzip,deflate, Content-Type=application/json}, HIS:[Require HTTP Basic Auth->[auth_key->false]], [Logstash can write and create its own indices->[indices->true, auth_key->true, actions->false]], [Kibana Server (we trust this server side component, full access granted via HTTP authentication)->[auth_key->false]], [Developer (reads only logstash indices, but can create new charts/dashboards)->[auth_key->false]] }
[2019-01-08T09:07:33,481][INFO ][t.b.r.a.ACL ] [jgeVQ7z] FORBIDDEN by default req={ ID:1613540594-271858237#22989, TYP:MainRequest, CGR:N/A, USR:logstash(?), BRS:true, KDX:null, ACT:cluster:monitor/main, OA:127.0.0.1, DA:127.0.0.1, IDX:<N/A>, MET:HEAD, PTH:/, CNT:<N/A>, HDR:{Authorization=<OMITTED>, content-length=0, Connection=Keep-Alive, User-Agent=Manticore 0.6.4, Host=localhost:9200, Accept-Encoding=gzip,deflate, Content-Type=application/json}, HIS:[Require HTTP Basic Auth->[auth_key->false]], [Logstash can write and create its own indices->[indices->true, auth_key->true, actions->false]], [Kibana Server (we trust this server side component, full access granted via HTTP authentication)->[auth_key->false]], [Developer (reads only logstash indices, but can create new charts/dashboards)->[auth_key->false]] }
[2019-01-08T09:07:33,483][INFO ][t.b.r.a.ACL ] [jgeVQ7z] FORBIDDEN by default req={ ID:28835601-492431185#22990, TYP:MainRequest, CGR:N/A, USR:logstash(?), BRS:true, KDX:null, ACT:cluster:monitor/main, OA:127.0.0.1, DA:127.0.0.1, IDX:<N/A>, MET:HEAD, PTH:/, CNT:<N/A>, HDR:{Authorization=<OMITTED>, content-length=0, Connection=Keep-Alive, User-Agent=Manticore 0.6.4, Host=localhost:9200, Accept-Encoding=gzip,deflate, Content-Type=application/json}, HIS:[Require HTTP Basic Auth->[auth_key->false]], [Logstash can write and create its own indices->[indices->true, auth_key->true, actions->false]], [Kibana Server (we trust this server side component, full access granted via HTTP authentication)->[auth_key->false]], [Developer (reads only logstash indices, but can create new charts/dashboards)->[auth_key->false]] }
[2019-01-08T09:07:33,486][INFO ][t.b.r.a.ACL ] [jgeVQ7z] FORBIDDEN by default req={ ID:2068055781-1176228242#22991, TYP:MainRequest, CGR:N/A, USR:logstash(?), BRS:true, KDX:null, ACT:cluster:monitor/main, OA:127.0.0.1, DA:127.0.0.1, IDX:<N/A>, MET:HEAD, PTH:/, CNT:<N/A>, HDR:{Authorization=<OMITTED>, content-length=0, Connection=Keep-Alive, User-Agent=Manticore 0.6.4, Host=localhost:9200, Accept-Encoding=gzip,deflate, Content-Type=application/json}, HIS:[Require HTTP Basic Auth->[auth_key->false]], [Logstash can write and create its own indices->[indices->true, auth_key->true, actions->false]], [Kibana Server (we trust this server side component, full access granted via HTTP authentication)->[auth_key->false]], [Developer (reads only logstash indices, but can create new charts/dashboards)->[auth_key->false]] }
[2019-01-08T09:07:33,488][INFO ][t.b.r.a.ACL ] [jgeVQ7z] FORBIDDEN by default req={ ID:513389603-1753945798#22992, TYP:MainRequest, CGR:N/A, USR:logstash(?), BRS:true, KDX:null, ACT:cluster:monitor/main, OA:127.0.0.1, DA:127.0.0.1, IDX:<N/A>, MET:HEAD, PTH:/, CNT:<N/A>, HDR:{Authorization=<OMITTED>, content-length=0, Connection=Keep-Alive, User-Agent=Manticore 0.6.4, Host=localhost:9200, Accept-Encoding=gzip,deflate, Content-Type=application/json}, HIS:[Require HTTP Basic Auth->[auth_key->false]], [Logstash can write and create its own indices->[indices->true, auth_key->true, actions->false]], [Kibana Server (we trust this server side component, full access granted via HTTP authentication)->[auth_key->false]], [Developer (reads only logstash indices, but can create new charts/dashboards)->[auth_key->false]] }
Thanks for your help.