# Not able to send logs to opensearch from logstash server, getting this warning message in the logs "\[o.o.s.a.BackendRegistry \] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'"

**URL:** <https://forum.opensearch.org/t/not-able-to-send-logs-to-opensearch-from-logstash-server-getting-this-warning-message-in-the-logs-o-o-s-a-backendregistry-no-authorization-header-send-401-and-www-authenticate-basic/14320>\
**Category:** Security\
**Created:** [May 12, 2023, 9:53am UTC](https://forum.opensearch.org/t/not-able-to-send-logs-to-opensearch-from-logstash-server-getting-this-warning-message-in-the-logs-o-o-s-a-backendregistry-no-authorization-header-send-401-and-www-authenticate-basic/14320 "2023-05-12T09:53:21Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![info2kool](https://avatars.discourse-cdn.com/v4/letter/i/9fc29f/32.png) [@info2kool](https://forum.opensearch.org/u/info2kool)\
**Post date:** [May 12, 2023, 9:53am UTC](https://forum.opensearch.org/t/not-able-to-send-logs-to-opensearch-from-logstash-server-getting-this-warning-message-in-the-logs-o-o-s-a-backendregistry-no-authorization-header-send-401-and-www-authenticate-basic/14320/1 "2023-05-12T09:53:21Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
opensearch 2.7.0

**Describe the issue** :  
Not able to send logs to opensearch from logstash server, getting this warning message in the logs “[o.o.s.a.BackendRegistry] No ‘Authorization’ header, send 401 and ‘WWW-Authenticate Basic’”

Any help would be highly appreciated

**Configuration** :

**Relevant Logs or Screenshots** :

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/2/2a24f00a529cd3082593f4a9392202d7f31cb5e3.png)

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [May 12, 2023, 2:44pm UTC](https://forum.opensearch.org/t/not-able-to-send-logs-to-opensearch-from-logstash-server-getting-this-warning-message-in-the-logs-o-o-s-a-backendregistry-no-authorization-header-send-401-and-www-authenticate-basic/14320/2 "2023-05-12T14:44:30Z")

</div>

Hi @info2kool

Could you send your output in the `pipeline.conf` file?

---

<div class="post-metadata">

**Author:** ![info2kool](https://avatars.discourse-cdn.com/v4/letter/i/9fc29f/32.png) [@info2kool](https://forum.opensearch.org/u/info2kool)\
**Post date:** [May 12, 2023, 5:37pm UTC](https://forum.opensearch.org/t/not-able-to-send-logs-to-opensearch-from-logstash-server-getting-this-warning-message-in-the-logs-o-o-s-a-backendregistry-no-authorization-header-send-401-and-www-authenticate-basic/14320/3 "2023-05-12T17:37:06Z")

</div>

Hi @Eugene7

Logstash version : 5.6.10  
Opensearch version : 2.7.0

After upgrading opensearch version from 1.2.3 to 2.7.0, I am getting these exceptions and logs are sending to opensearch.

Here is the .conf file.

input {  
syslog {  
type =\> syslog  
port =\> 51415  
}  
rabbitmq {  
queue =\> “logs\_unicast”  
host =\> [“svrl-dkr1”, “svrl-dkr2”, “svrl-dkr3”]  
exchange =\> “amq.rabbitmq.log”  
exchange\_type =\> “topic”  
durable =\> true  
key =\> “#”  
type =\> syslog  
add\_field =\> {  
“program” =\> “rabbitmq-log”  
}  
}  
}  
filter {  
if “docker/” in [program] {  
mutate {  
add\_field =\> {  
“container\_id” =\> “%{program}”  
}  
}  
mutate {  
gsub =\> [  
“container\_id”, “docker/”, “”  
]  
}  
mutate {  
update =\> [  
“program”, “docker”  
]  
}  
}  
if “GET / HTTP/1.0” in [message] {  
drop{ }  
}  
}  
output {  
stdout {  
codec =\> rubydebug  
}  
elasticsearch {  
user =\> “admin”  
password =\> “admin”  
hosts =\> [“10.10.10.10:9200”,“10.10.10.10:9200”]  
index =\> “dev-logs-%{+xxxx.ww}”  
}  
}

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [May 16, 2023, 3:30pm UTC](https://forum.opensearch.org/t/not-able-to-send-logs-to-opensearch-from-logstash-server-getting-this-warning-message-in-the-logs-o-o-s-a-backendregistry-no-authorization-header-send-401-and-www-authenticate-basic/14320/4 "2023-05-16T15:30:22Z")

</div>

Have you tried to use the OpenSearch output plugin? If not, please change your output configuration as per the documentation below:

> **[Ship events to OpenSearch](https://opensearch.org/docs/2.7/tools/logstash/ship-to-opensearch/#adding-different-authentication-mechanisms-in-the-output-plugin)**
>
> Ship events to OpenSearch

Have you enabled the option `plugins.security.ssl.http.enabled` ?

---

<div class="post-metadata">

**Author:** ![info2kool](https://avatars.discourse-cdn.com/v4/letter/i/9fc29f/32.png) [@info2kool](https://forum.opensearch.org/u/info2kool)\
**Post date:** [May 16, 2023, 5:36pm UTC](https://forum.opensearch.org/t/not-able-to-send-logs-to-opensearch-from-logstash-server-getting-this-warning-message-in-the-logs-o-o-s-a-backendregistry-no-authorization-header-send-401-and-www-authenticate-basic/14320/5 "2023-05-16T17:36:02Z")

</div>

@Eugene7 I have tried this but opensearch output plugin is not there in that logstash version 5.6.10 which I am using. So it will not recognize this plugin.

Have you enabled the option `plugins.security.ssl.http.enabled? - No I haven’t enabled this ssl security

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [May 17, 2023, 12:59pm UTC](https://forum.opensearch.org/t/not-able-to-send-logs-to-opensearch-from-logstash-server-getting-this-warning-message-in-the-logs-o-o-s-a-backendregistry-no-authorization-header-send-401-and-www-authenticate-basic/14320/6 "2023-05-17T12:59:09Z")

</div>

Hi @info2kool  
According to the documentation here: [Tools - OpenSearch documentation](https://opensearch.org/docs/latest/tools/index/#compatibility-matrices) , you use the Logstash version, which is not compatible with your OpenSearch version. Please try to use another version of Logstash.

---

<div class="post-metadata">

**Author:** ![info2kool](https://avatars.discourse-cdn.com/v4/letter/i/9fc29f/32.png) [@info2kool](https://forum.opensearch.org/u/info2kool)\
**Post date:** [May 17, 2023, 3:47pm UTC](https://forum.opensearch.org/t/not-able-to-send-logs-to-opensearch-from-logstash-server-getting-this-warning-message-in-the-logs-o-o-s-a-backendregistry-no-authorization-header-send-401-and-www-authenticate-basic/14320/7 "2023-05-17T15:47:48Z")

</div>

Hi @Eugene7 I installed logstash 7.16.3 version later and still got the same errors. Is it because of the lucene version change in Opensearch 2.7 ? Opensearch 2.7 lucene version is 9 where as logstash lucene versions which I used was 8.

---

<div class="post-metadata">

**Author:** ![Saidose](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/saidose/32/4196_2.png) [@Saidose](https://forum.opensearch.org/u/Saidose)\
**Post date:** [May 17, 2023, 11:55pm UTC](https://forum.opensearch.org/t/not-able-to-send-logs-to-opensearch-from-logstash-server-getting-this-warning-message-in-the-logs-o-o-s-a-backendregistry-no-authorization-header-send-401-and-www-authenticate-basic/14320/8 "2023-05-17T23:55:24Z")

</div>

@info2kool I found that under output section you use:  
elasticsearch {  
user =\> “admin”  
password =\> “admin”  
hosts =\> [“10.10.10.10:9200”,“10.10.10.10:9200”]  
index =\> “dev-logs-%{+xxxx.ww}”  
}

Is it still the same after you updated your logstash?  
It should be (I might be wrong):  
opensearch {  
user =\> “admin”  
password =\> “admin”  
hosts =\> [“10.10.10.10:9200”,“10.10.10.10:9200”]  
index =\> “dev-logs-%{+xxxx.ww}”  
}  
And in Logstash settings you need to disable ecs.compatibility.mode (don’t remember the actual name of setting)

Moreover in ouput you can specify something like this:  
opensearch {  
auth\_type =\> {  
type =\> basic  
user =\> “admin”  
password =\> “admin”  
}  
hosts =\> [“10.10.10.10:9200”,“10.10.10.10:9200”]  
index =\> “dev-logs-%{+xxxx.ww}”  
}