I suspect you are not using the ROR Kibana plugin (PRO/Enterprise) and you are facing that old (but still valid) Kibana issue where some request don’t carry the Authorization header.
If this is the case, I provided explanation and a workaround in this thread: