Briefly, this error occurs when the Elasticsearch client fails to authenticate with the Elasticsearch server. This could be due to incorrect credentials, or the server may require an authentication method not supported by the client. To resolve this, ensure that the correct username and password are being used. If using an API key, verify it’s valid. If the server requires a specific authentication method, ensure the client supports it. Also, check the server’s authentication settings and logs for more details. If all else fails, consider resetting the credentials or reconfiguring the server’s authentication settings.
This guide will help you check for common problems that cause the log ” {}[rest] [authentication_failed]\t{}; uri=[{}]{} ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin.
Log Context
Log “{}[rest] [authentication_failed]\t{}; uri=[{}]{}” classname is DeprecatedLoggingAuditTrail.java.
We extracted the following from Elasticsearch source code for those seeking an in-depth context :
&& (eventFilterPolicyRegistry.ignorePredicate().test(AuditEventMetaInfo.EMPTY) == false)) {
if (includeRequestBody) {
logger.info("{}[rest] [authentication_failed]\t{}; uri=[{}]{}; request_body=[{}]"; localNodeInfo.prefix;
hostAttributes(request); request.uri(); opaqueId(); restRequestContent(request));
} else {
logger.info("{}[rest] [authentication_failed]\t{}; uri=[{}]{}"; localNodeInfo.prefix; hostAttributes(request);
request.uri(); opaqueId());
}
}
}
