[Logstash::Outputs::ElasticSearch] Failed to authenticate user … – credential reload without pipeline restart
0 reputation · 05 Jun 2025, 18:17 UTC
Allow the Logstash Elasticsearch output plugin to detect updates to username/password or API key stored in the Logstash keystore and apply the new credentials without requiring a pipeline reload or process restart, thereby supporting automated least‑privilege credential rotation.
The plugin currently logs an authentication failure such as '[Logstash::Outputs::ElasticSearch] Failed to authenticate user …' and stops sending events until the operator manually reloads the pipeline or restarts Logstash; there is no built‑in mechanism to watch the keystore for changes or to retry authentication after a secret has been rotated.
Which mechanism can Logstash use to detect keystore updates and reload credentials safely? How can the plugin be configured to retry authentication automatically after a credential change without losing in‑flight events?