Rest authentication failed t principal= uri= - Common causes and quick fixes

Rest authentication failed t principal= uri= – How to solve this Elasticsearch error

Opster Team

Aug-23, Version: 6.8-6.8

Briefly, this error occurs when the Elasticsearch REST API cannot authenticate the user due to incorrect or missing credentials. This could be due to a wrong username/password, expired tokens, or misconfigured role-based access control. To resolve this issue, you can: 1) Verify the correctness of your credentials; 2) Check if the authentication token is still valid; 3) Review your role-based access control settings to ensure the user has the necessary permissions; 4) Ensure that the user is correctly mapped to the role in Elasticsearch.

This guide will help you check for common problems that cause the log ” {}[rest] [authentication_failed]\t{}; principal=[{}]; uri=[{}]{} ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin.

Log Context

Log “{}[rest] [authentication_failed]\t{}; principal=[{}]; uri=[{}]{}” classname is DeprecatedLoggingAuditTrail.java.
We extracted the following from Elasticsearch source code for those seeking an in-depth context :

                .test(new AuditEventMetaInfo(Optional.of(token); Optional.empty(); Optional.empty())) == false)) {
            if (includeRequestBody) {
                logger.info("{}[rest] [authentication_failed]\t{}; principal=[{}]; uri=[{}]{}; request_body=[{}]"; localNodeInfo.prefix;
                        hostAttributes(request); token.principal(); request.uri(); opaqueId(); restRequestContent(request));
            } else {
                logger.info("{}[rest] [authentication_failed]\t{}; principal=[{}]; uri=[{}]{}"; localNodeInfo.prefix;
                        hostAttributes(request); token.principal(); request.uri(); opaqueId());
            }
        }
    }