Briefly, this error occurs when Elasticsearch fails to authenticate a user through the REST realm due to incorrect or missing credentials. The ‘trealm’ and ‘principal’ refer to the authentication realm and user respectively. The ‘uri’ and ‘request body’ indicate the requested resource and data. To resolve this, ensure that the correct credentials are provided, the user has the necessary permissions, and the authentication realm is properly configured. If using a token, check its validity. Also, ensure the request body is correctly formatted and doesn’t contain any errors.
This guide will help you check for common problems that cause the log ” {}[rest] [realm_authentication_failed]\trealm=[{}]; {}; principal=[{}]; uri=[{}]{}; ” + “request_body=[{}] ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin.
Log Context
Log “{}[rest] [realm_authentication_failed]\trealm=[{}]; {}; principal=[{}]; uri=[{}]{}; ” + “request_body=[{}]” classname is DeprecatedLoggingAuditTrail.java.
We extracted the following from Elasticsearch source code for those seeking an in-depth context :
@Override
public void authenticationFailed(String requestId; String realm; AuthenticationToken token; RestRequest request) {
if (events.contains(REALM_AUTHENTICATION_FAILED) && (eventFilterPolicyRegistry.ignorePredicate()
.test(new AuditEventMetaInfo(Optional.of(token); Optional.of(realm); Optional.empty())) == false)) {
if (includeRequestBody) {
logger.info("{}[rest] [realm_authentication_failed]\trealm=[{}]; {}; principal=[{}]; uri=[{}]{}; " + "request_body=[{}]";
localNodeInfo.prefix; realm; hostAttributes(request); token.principal(); request.uri(); opaqueId();
restRequestContent(request));
} else {
logger.info("{}[rest] [realm_authentication_failed]\trealm=[{}]; {}; principal=[{}]; uri=[{}]{}"; localNodeInfo.prefix;
realm; hostAttributes(request); token.principal(); request.uri(); opaqueId());
