Rest authentication failed t principal= uri= request body= – How to solve this Elasticsearch error

Opster Team

Aug-23, Version: 6.8-6.8

Briefly, this error occurs when Elasticsearch fails to authenticate a user trying to access its REST API. This could be due to incorrect credentials or a misconfigured security setting. To resolve this issue, you can: 1) Verify the credentials being used for authentication. 2) Check the Elasticsearch security settings to ensure that the user has the necessary permissions. 3) If using a security plugin, ensure it is correctly configured and up-to-date. 4) Check the application making the request to ensure it is correctly encoding the credentials.

This guide will help you check for common problems that cause the log ” {}[rest] [authentication_failed]t{}; principal=[{}]; uri=[{}]{}; request_body=[{}] ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin.

Log Context

Log “{}[rest] [authentication_failed]t{}; principal=[{}]; uri=[{}]{}; request_body=[{}]” classname is
We extracted the following from Elasticsearch source code for those seeking an in-depth context :

    public void authenticationFailed(String requestId; AuthenticationToken token; RestRequest request) {
        if (events.contains(AUTHENTICATION_FAILED) && (eventFilterPolicyRegistry.ignorePredicate()
                .test(new AuditEventMetaInfo(Optional.of(token); Optional.empty(); Optional.empty())) == false)) {
            if (includeRequestBody) {
      "{}[rest] [authentication_failed]\t{}; principal=[{}]; uri=[{}]{}; request_body=[{}]"; localNodeInfo.prefix;
                        hostAttributes(request); token.principal(); request.uri(); opaqueId(); restRequestContent(request));
            } else {
      "{}[rest] [authentication_failed]\t{}; principal=[{}]; uri=[{}]{}"; localNodeInfo.prefix;
                        hostAttributes(request); token.principal(); request.uri(); opaqueId());


How helpful was this guide?

We are sorry that this post was not useful for you!

Let us improve this post!

Tell us how we can improve this post?