title: Logstash authentication
body: <p>I'm setting up a logstash cluster and I configured some authentication regarding the output filter.
  However I can't figure out why it isn't working...</p>
  
  <p>I tried brackets, no brackets, IP, FQDN... </p>
  
  <pre><code>input {
    tcp {
      port =&gt; 5000
      type =&gt; syslog
    }
    udp {
      port =&gt; 5000
      type =&gt; syslog
    }
  }
  
  filter {
    if [type] == "syslog" {
      grok {
        match =&gt; { "message" =&gt; "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
        add_field =&gt; [ "received_at", "%{@timestamp}" ]
        add_field =&gt; [ "received_from", "%{host}" ]
      }
       date {
        match =&gt; [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
      }
    }
  }
  
  output {
    elasticsearch { hosts =&gt; ["localhost.enedis.fr:9200"] }
    user = sec-svc-log01
    password =&gt; 3N3D1S!!
    stdout { codec =&gt; rubydebug }
  }
  </code></pre>
  
  <p>Am I missing something ? 
  Thanks for your help !</p>