Unable to run logstash from logstash user

Hi,

I am unable to push data in to ES from logstash when using logstash user. it starts giving belwo error

Attempted to resurrect connection to dead ES instance, but got an error. {:url=>“http://logstash:[email protected]:9200/”,

But when i try to use kibna user instead of logstash it works fine.

Below is my logstash.conf file

input {
jdbc {

jdbc_driver_library => “/Users/usmanniazi/Downloads/logstash-7.7.0/db2jcc4.jar”
jdbc_driver_class => “com.ibm.db2.jcc.DB2Driver”
jdbc_connection_string => “jdbc:db2://host:port/db”
jdbc_user => “user”
jdbc_password => “pass”
#ssl_key => “/home/mesadmin/Downloads/logstash-7.6.2/hwsw360.w3-969.ibm.com.key”
#ssl_certificate => “/home/mesadmin/Downloads/logstash-7.6.2/cert.crt”
#last_run_metadata_path => “/home/mesadmin/Downloads/logstash-7.6.2/.logstash_jdbc_last_run”
#use_column_value => “true”
#tracking_column => “insert_ts”
#tracking_column_type => “timestamp”
#tracking_column => “_sequence_key”
statement_filepath => “/Users/usmanniazi/Downloads/logstash-7.7.0/ilm.sql”
#schedule => “* * * * *”
}
}
output {
elasticsearch {
hosts => [“localhost:9200”]
index => “ilm_data”
user => [“logstash”]
password => [“logstash”]
}
}

and below is my logstash user configuration in ROR.yml file

- name: "Logstash can write and create its own indices"
  auth_key: logstash:logstash
  type: allow
#  kibana_access: ro
  actions: ["indices:data/read/*","indices:data/write/*","indices:admin/template/*","indices:admin/create"]
  indices: ["logstash-*","ilm_data",".kibana*","<no-index>"]

If your logstash requests are getting rejected, you have to inspect elasticsearch.log and find the log line that says “FORBIDDEN”.