# Opensearch Dashboards Security Plugin causes the Dashboards to stop working (ECONNREFUSED)

**URL:** <https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234>\
**Category:** Security\
**Created:** [October 17, 2022, 8:29pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234 "2022-10-17T20:29:54Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 17, 2022, 8:29pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/1 "2022-10-17T20:29:54Z")

</div>

Hi,

I’m running Opensearch v2.2.0 with self signed certs for the OS security plugin.

The configured ldap authc & authz in config.yml works fine and I’m able to run https REST API based querys, but since setting the “plugins.security.disabled: false” in opensearch.yml & installation of the OS dashboards security plugin - all dashboard logins fails with an  
“**[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200**” error in /var/log/opensearch/opensearch-dashboard log.

If I set the “plugins.security.disabled: true” setting back and remove the /usr/opensearch-dashboards/plugins/securityDashboards plugin the OS Dashboards starts working again, but then REST API querys cannot run through https since it requires the security plugin

Do anyone know how to resolve this issue?

opensearch\_dashboards.yml config. below,

server.host: “127.0.0.1”  
opensearch.hosts: [http:/127.0.0.1:9200]  
opensearch.ssl.verificationMode: none  
opensearch.username: kibanaserver  
opensearch.password: kibanaserver  
opensearch.requestHeadersAllowlist: [authorization, securitytenant]  
opensearch\_security.multitenancy.enabled: false  
opensearch\_security.multitenancy.tenants.enable\_global: true  
opensearch\_security.multitenancy.tenants.enable\_private: true  
opensearch\_security.multitenancy.tenants.preferred: [“Private”, “Global”]  
opensearch\_security.multitenancy.enable\_filter: false  
opensearch\_security.readonly\_mode.roles: [kibana\_read\_only]  
logging.dest: /var/log/opensearch/opensearch-dashboard.log  
logging.quiet: false  
server.ssl.enabled: false

opensearch.yml below,

plugins.security.ssl.transport.pemcert\_filepath: ./cert/node1.pem  
plugins.security.ssl.transport.pemkey\_filepath: ./cert/node1-key.pem  
plugins.security.ssl.transport.pemtrustedcas\_filepath: ./cert/root-ca.pem  
plugins.security.ssl.transport.enforce\_hostname\_verification: false  
**plugins.security.ssl.http.enabled: true**  
**plugins.security.ssl.http.pemcert\_filepath: ./cert/node1.pem**  
**plugins.security.ssl.http.pemkey\_filepath: ./cert/node1-key.pem**  
**plugins.security.ssl.http.pemtrustedcas\_filepath: ./cert/root-ca.pem**  
**plugins.security.ssl.http.clientauth\_mode: OPTIONAL**  
plugins.security.allow\_default\_init\_securityindex: true  
plugins.security.authcz.admin\_dn:  
‘CN=XX,OU=XX,O=XX,L=XX,ST=XX,C=SE’  
plugins.security.nodes\_dn:  
‘CN=XX,OU=XX,O=XX,L=XX,ST=XX,C=SE’  
plugins.security.audit.type: internal\_opensearch  
plugins.security.enable\_snapshot\_restore\_privilege: true  
plugins.security.check\_snapshot\_restore\_write\_privileges: true  
plugins.security.restapi.roles\_enabled: [“all\_access”, “security\_rest\_api\_access”]  
plugins.security.system\_indices.enabled: true  
plugins.security.system\_indices.indices: [“.plugins-ml-model”, “.plugins-ml-task”, “.opendistro-alerting-config”, “.opendistro-alerting-alert\*”, “.opendistro-anomaly-results\*”, “.opendistro-anomaly-detector\*”, “.opendistro-anomaly-checkpoints”, “.opendistro-anomaly-detection-state”, “.opendistro-reports-_", ".opensearch-notifications-_”, “.opensearch-notebooks”, “.opensearch-observability”, “.opendistro-asynchronous-search-response\*”, “.replication-metadata-store”]  
node.max\_local\_storage\_nodes: 3  
plugins.security.disabled: **false**

parts of config.yml below,

```
  basic_internal_auth_domain:
    description: "Authenticate via HTTP Basic against internal users database"
    http_enabled: true
    transport_enabled: true
    order: 0
    http_authenticator:
      type: basic
      challenge: true
    authentication_backend:
      type: intern

  ldap:
    description: "Authenticate via LDAP or Active Directory"
    http_enabled: true
    transport_enabled: true
    order: 4
    http_authenticator:
      type: basic
      challenge: true

authz:
  roles_from_myldap:
    description: "Authorize via LDAP or Active Directory"
    http_enabled: true
    transport_enabled: true
    authorization_backend:
      type: ldap
      config:

```

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 18, 2022, 8:16am UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/2 "2022-10-18T08:16:44Z")

</div>

@denkar You have the following set in opensearch\_dashboards.yml file.

```auto
opensearch.hosts: [http:/127.0.0.1:9200]

```

When security plugin is enabled and `plugins.security.ssl.http.enabled` set to true the only available communication is over HTTPS.  
Either use `https:/127.0.0.1:9200` in opensearch\_dashboards.yml or set false in `plugins.security.ssl.http.enabled`.

Please be aware that `plugins.security.ssl.http.enabled` has to be set to true if you want to use securityadmin.sh script.

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 18, 2022, 11:27am UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/3 "2022-10-18T11:27:30Z")

</div>

@pablo  
Thank you for helping out, but now after I made the change from http to https I get a Proxy error in the browser.

Proxy Error  
The proxy server received an invalid response from an upstream server.  
The proxy server could not handle the request  
Reason: Error reading from remote server

I also added my self signed certs to the opensearch\_dashboards.yml file and enabled ssl, se below

server.host: “127.0.0.1”

opensearch.hosts: [https:/xxx.xxx.xx:9200]  
opensearch.ssl.verificationMode: certificate  
opensearch.username: kibanaserver  
opensearch.password: kibanaserver  
opensearch.requestHeadersAllowlist: [authorization, securitytenant]  
opensearch\_security.multitenancy.enabled: false  
opensearch\_security.multitenancy.tenants.enable\_global: true  
opensearch\_security.multitenancy.tenants.enable\_private: true  
opensearch\_security.multitenancy.tenants.preferred: [“Private”, “Global”]  
opensearch\_security.multitenancy.enable\_filter: false  
opensearch\_security.readonly\_mode.roles: [kibana\_read\_only]  
opensearch.ssl.certificateAuthorities:  
[/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem]  
server.ssl.enabled: true  
server.ssl.certificate: /usr/opensearch/config/cert/node1.pem  
server.ssl.key: /usr/opensearch/config/cert/node1-key.pem

logging.dest: /var/log/opensearch/opensearch-dashboard.log  
logging.quiet: false

(Tried with setting opensearch.hosts: to 127.0.0.1 and to the cn specified in opensearch.yml under plugins.security.nodes\_dn but both fails.)

log error messages:  
{“type”:“log”,“@timestamp”:“2022-10-18T09:54:40Z”,“tags”:[“info”,“plugins-system”],“pid”:1118,“message”:“Setting up [46] plugins: [alertingDashboards,mapsLegacy,usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,share,opensearchUiShared,legacyExport,expressions,data,home,apmOss,console,management,indexPatternManagement,advancedSettings,savedObjects,reportsDashboards,securityDashboards,anomalyDetectionDashboards,indexManagementDashboards,queryWorkbenchDashboards,notificationsDashboards,embeddable,dashboard,visualizations,visTypeVega,visTypeMarkdown,visTypeTimeline,timeline,visTypeTable,tileMap,regionMap,customImportMapDashboards,inputControlVis,ganttChartDashboards,visualize,bfetch,charts,visTypeVislib,visTypeMetric,visTypeTimeseries,visTypeTagcloud,observabilityDashboards,discover,savedObjectsManagement]”}  
{“type”:“log”,“@timestamp”:“2022-10-18T09:54:41Z”,“tags”:[“info”,“savedobjects-service”],“pid”:1118,“message”:“Waiting until all OpenSearch nodes are compatible with OpenSearch Dashboards before starting saved objects migrations…”}  
{“type”:“log”,“@timestamp”:“2022-10-18T09:54:41Z”,“tags”:[“error”,“opensearch”,“data”],“pid”:1118,“message”:“[ConnectionError]: connect ECONNREFUSED 10.126.2.108:9200”}  
{“type”:“log”,“@timestamp”:“2022-10-18T09:54:41Z”,“tags”:[“error”,“savedobjects-service”],“pid”:1118,“message”:“Unable to retrieve version information from OpenSearch nodes.”}  
{“type”:“log”,“@timestamp”:“2022-10-18T09:54:44Z”,“tags”:[“error”,“opensearch”,“data”],“pid”:1118,“message”:“[ConnectionError]: connect ECONNREFUSED 10.126.2.108:9200”}

But the https REST API works…

A small example from an https REST API query below,  
curl -v -XGET “[https://xxx.xxx.xxx:9200/\_plugins/\_security/api/rolesmapping](https://xxx.xxx.xxx:9200/_plugins/_security/api/rolesmapping)” -u xx:xx -ks | jq

query result:

“all\_access”: {  
“hosts”: [  
“_"  
],  
“users”: [  
"_”  
],  
“reserved”: false,  
“hidden”: false,  
“backend\_roles”: [  
“ldap\_test”  
],  
“and\_backend\_roles”:   
},

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 18, 2022, 1:14pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/4 "2022-10-18T13:14:46Z")

</div>

@denkar

```auto
server.host: “127.0.0.1”

```

With that setting OpenSearch Dashboards will be available only from localhost?

Do you run Opensearch and OpenSearch Dashboards on the same machine?  
Could you describe your OpenSearch infrastructure?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 18, 2022, 1:17pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/5 "2022-10-18T13:17:24Z")

</div>

> [@denkar](#):
>
> opensearch.ssl.verificationMode: certificate

Please check this link. It describes how to use `opensearch.ssl.verificationMode` and `opensearch.ssl.certificateAuthorizites`.

> **[Configure TLS](https://opensearch.org/docs/latest/dashboards/install/tls/)**
>
> Configure TLS for OpenSearch Dashboards

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 18, 2022, 1:17pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/6 "2022-10-18T13:17:57Z")

</div>

@pablo

Opensearch and Opensearch dashboards are installed on the same host.  
(A linux standalone VM with Apache)

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 18, 2022, 1:19pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/7 "2022-10-18T13:19:18Z")

</div>

@denkar I understand that you access the OpenSearch Dashboards directly from that Linux VM, am I correct?

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 18, 2022, 1:50pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/8 "2022-10-18T13:50:04Z")

</div>

@pablo

I access the Opensearch env. via my web browser from another client machine in the same network.

Client \<–\> https \<–\> VM Apache ProxyPass / [http://127.0.0.1:5601/](http://127.0.0.1:5601/) \<–\> Opensearch Dashboards

Dashboard access works fine as long as the security plugin is disabled and the securityDashboards are removed from the /usr/opensearch-dashboards/plugins directory

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 18, 2022, 2:51pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/9 "2022-10-18T14:51:14Z")

</div>

@pablo

The only thing that does not work is the https access to the OS Dashboards when REST API https (with self signed certs) is enabled, otherwise it works.

Do you see any changes that might need to be made in the opensearch\_dashboards.yml file or in the config.yml file in order to make this work?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 18, 2022, 3:18pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/10 "2022-10-18T15:18:40Z")

</div>

@denkar I wasn’t aware of the proxy.  
This section:

```auto
server.ssl.enabled: true
server.ssl.certificate: /usr/opensearch/config/cert/node1.pem
server.ssl.key: /usr/opensearch/config/cert/node1-key.pem

```

as per documentation is used for the browser - OSD connection.

In your case proxy acts as a client for OSD. To keep the current configuration of your proxy you should remove/comment out the above lines.

Regarding the connection between OSD and OS, can you try to use the below?

```auto
opensearch.ssl.verificationMode: none

```

If you’d like to use **certificate** instead of **none** , then the certificate defined in `opensearch.ssl.certificateAuthorities` must be exactly the same as the one defined in `plugins.security.ssl.http.pemtrustedcas_filepath` in opensearch.yml.

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 18, 2022, 7:08pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/11 "2022-10-18T19:08:41Z")

</div>

@pablo

I have disabled the Apache proxy service just too keep it out of the equation.

I also changed the OSD server.host from 127.0.0.1 to 10.126.2.108 to make OSD accessible over the network.  
The ssl cert paths now also match the settings I used to get the REST API https working.

My new opensearch\_dashboards.yml below,

server.host: “10.126.2.108”  
opensearch.hosts: [[https://127.0.0.1:9200](https://127.0.0.1:9200)]  
opensearch.ssl.verificationMode: none  
opensearch.username: kibanaserver  
opensearch.password: kibanaserver  
opensearch.requestHeadersAllowlist: [authorization, securitytenant]

logging.dest: /var/log/opensearch/opensearch-dashboard.log  
logging.quiet: false

opensearch\_security.multitenancy.enabled: false  
opensearch\_security.multitenancy.tenants.enable\_global: true  
opensearch\_security.multitenancy.tenants.enable\_private: true  
opensearch\_security.multitenancy.tenants.preferred: [“Private”, “Global”]  
opensearch\_security.multitenancy.enable\_filter: false  
opensearch\_security.readonly\_mode.roles: [kibana\_read\_only]  
opensearch.ssl.certificateAuthorities:  
[/usr/opensearch/config/cert/root-ca.pem]

server.ssl.enabled: true  
server.ssl.certificate: /usr/opensearch/config/cert/node1.pem  
server.ssl.key: /usr/opensearch/config/cert/node1-key.pem

Restarted the server but I still get the connection errors…

{“type”:“log”  
,“@timestamp”:“2022-10-18T19:05:01Z”,“tags”:[“error”,“opensearch”,“data”],“pid”:1119,“message”:“[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200”}

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 18, 2022, 10:26pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/12 "2022-10-18T22:26:45Z")

</div>

@pablo

Thank you for all the help, finally managed to got it working.

For anyone who is interested or are having the same type of problem, my version of opensearch\_dashboard.yml is below,

server.host: “127.0.0.1”  
opensearch.hosts: [[https://localhost:9200](https://localhost:9200)]  
opensearch.ssl.verificationMode: none  
opensearch.username: kibanaserver  
opensearch.password: kibanaserver  
opensearch.requestHeadersAllowlist: [authorization,securitytenant]

logging.dest: /var/log/opensearch/opensearch-dashboard.log  
logging.quiet: false

opensearch\_security.multitenancy.enabled: true  
opensearch\_security.multitenancy.tenants.enable\_global: true  
opensearch\_security.multitenancy.tenants.enable\_private: true  
opensearch\_security.multitenancy.tenants.preferred: [“Private”, “Global”]  
opensearch\_security.multitenancy.enable\_filter: false  
opensearch\_security.readonly\_mode.roles: [kibana\_read\_only]  
opensearch.ssl.certificateAuthorities: [“/usr/opensearch/config/cert/root-ca.pem”]

#server.ssl.enabled: true  
#server.ssl.certificate: /usr/opensearch/config/cert/localhost.pem  
#server.ssl.key: /usr/opensearch/config/cert/localhost-key.pem  
#opensearch\_security.cookie.secure: true

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 19, 2022, 7:54am UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/13 "2022-10-19T07:54:31Z")

</div>

@pablo

Now when OSD and REST API is working via SSL/TLS I noticed that the logstash output stream doesnt work although I added my self signed root cert to the output config. (Logstash is Installed on a separate linux VM)  
root-ca.pem file permissions are set the same as on the OS machine, and there are no firewall restrictions between the machines.

Any idea what I may be missing?

Logstash output config. is below,

output {  
opensearch {  
hosts =\> [“[https://xx.xx.xx:9200](https://xx.xx.xx:9200)”]  
ssl =\> true  
ssl\_certificate\_verification =\> false  
cacert =\> ‘/usr/logstash-8081/cert/root-ca.pem’  
user =\> xxx  
password =\> xxx  
index =\> “%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}”  
}  
}

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 19, 2022, 12:53pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/14 "2022-10-19T12:53:38Z")

</div>

@denkar You can remove `cacert` from the config when you have `ssl_certificate_verification` set to **false**.

```auto
output {
   opensearch {
      hosts => [“https://xx.xx.xx:9200”]
      ssl => true
      ssl_certificate_verification => false
      user => xxx
      password => xxx
      index => “%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}”
  }
}

```

The user must have either `logstash` backend role assigned

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/3c232311a6d66e1d1a848aaeecc6180d5e85089b.png)

> **[Users and roles](https://opensearch.org/docs/latest/security-plugin/access-control/users-roles/)**
>
> Users and roles

or be an admin.

> **[Ship events to OpenSearch](https://opensearch.org/docs/latest/clients/logstash/ship-to-opensearch/)**
>
> Ship events to OpenSearch

However, I would avoid using an admin user in this scenario.

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 19, 2022, 6:31pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/15 "2022-10-19T18:31:59Z")

</div>

@pablo

I created a new internal user and assigned it the logstash backend role,  
and modified the logstash output section to:

output {  
opensearch {  
hosts =\> [“[https://xx.xx.xx:9200](https://xx.xx.xx:9200)”]  
ssl =\> true  
ssl\_certificate\_verification =\> false  
user =\> “XX”  
password =\> “XX”  
index =\> “%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}”  
}  
}

Then I started up the logstash service, and noticed that no errors are registered in the logstash log file, which looks fine - but no events arrive in Opensearch and no new index gets created.

A short excerpt from the logstash log below,

[2022-10-19T19:32:19,617][INFO][logstash.javapipeline][beats] Pipeline Java execution initialization time {“seconds”=\>0.83}  
[2022-10-19T19:32:19,636][INFO][logstash.inputs.beats][beats] Starting input listener {:address=\>“0.0.0.0:8081”}  
[2022-10-19T19:32:19,811][INFO][logstash.javapipeline][beats] Pipeline started {“pipeline.id”=\>“beats”}  
[2022-10-19T19:32:19,870][INFO][org.logstash.beats.Server][beats][687ac856222a272055e527225e22104051e5d7268d41b584259f23eb41def7aa] Starting server on port: 8081  
[2022-10-19T19:32:20,131][WARN][logstash.outputs.opensearch][filebeat-message-pl] Restored connection to OpenSearch instance {:url=\>“[https://xxxxx:xxxxxx@xx.xx.xx:9200/](https://xxxxx:xxxxxx@xx.xx.xx:9200/)”}  
[2022-10-19T19:32:20,205][INFO][logstash.outputs.opensearch][filebeat-message-pl] Cluster version determined (2.2.0) {:version=\>2}  
[2022-10-19T19:32:20,262][INFO][logstash.outputs.opensearch][filebeat-message-pl] Using a default mapping template {:version=\>2, :ecs\_compatibility=\>:disabled}  
[2022-10-19T19:32:20,549][INFO][logstash.javapipeline][filebeat-message-pl] Starting pipeline {:pipeline\_id=\>“filebeat-message-pl”, “pipeline.workers”=\>4, “pipeline.batch.size”=\>125, “pipeline.batch.delay”=\>50, “pipeline.max\_inflight”=\>500, “pipeline.sources”=\>[“/usr/logstash-8081/config/conf.d/02-filebeat-message-pipeline.conf”], :thread=\>“#\<Thread:0x77170a0d run\>”}  
[2022-10-19T19:32:21,167][INFO][logstash.javapipeline][filebeat-message-pl] Pipeline Java execution initialization time {“seconds”=\>0.62}  
[2022-10-19T19:32:21,185][INFO][logstash.javapipeline][filebeat-message-pl] Pipeline started {“pipeline.id”=\>“filebeat-message-pl”}  
[2022-10-19T19:32:21,205][INFO][logstash.agent] Pipelines running {:count=\>2, :running\_pipelines=\>[:beats, :“filebeat-message-pl”], :non\_running\_pipelines=\>}

Do I need to specify my self signed root cert and client cert + key in the output section to get this working with the OS security plugin ?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 20, 2022, 2:10pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/16 "2022-10-20T14:10:21Z")

</div>

@denkar With `ssl_certificate_verification => false` in the output you don’t need to specify any certificates.  
Maybe either your filtering in logstash doesn’t work or filebeat doesn’t send any data to logstash.  
Try testing with the admin user or assign the admin backend role to the existing logstash user.

Since logstash can connect to OpenSearch, this is no longer a security plugin issue.

```auto
[2022-10-19T19:32:20,131][WARN][logstash.outputs.opensearch][filebeat-message-pl] Restored connection to OpenSearch instance {:url=>“https://xxxxx:xxxxxx@xx.xx.xx:9200/”}

```

Try following OpenSearch documentation for further Logstash troubleshooting.

> **[Logstash](https://opensearch.org/docs/1.0/clients/logstash/index/)**
>
> Logstash

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 20, 2022, 11:14pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/17 "2022-10-20T23:14:21Z")

</div>

@pablo

You were right, my logstash vm was not sending any data  
Now everything works - thank you for all the help in this troubleshooting

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 24, 2022, 11:24am UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/18 "2022-10-24T11:24:34Z")

</div>

@pablo

Is it possible to hide the Security plugin menu in OSD from standard readonly users?  
(I mean the whole “Security” menu option under Opensearch Plugins → Security)

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 24, 2022, 6:09pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/19 "2022-10-24T18:09:54Z")

</div>

@denkar I’ve just created a user with a kibana\_user role only and the Security tab wasn’t there.  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/d/d035843a3fddf1e89d4665ad2c9b29535b0433ce.png)

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [October 24, 2022, 6:19pm UTC](https://forum.opensearch.org/t/opensearch-dashboards-security-plugin-causes-the-dashboards-to-stop-working-econnrefused/11234/20 "2022-10-24T18:19:36Z")

</div>

@pablo

ok, perfect.  
Now it looks really good for ro users