Spring Boot 2.7.4连接Elasticsearch 8.9.2遇HTTP 401认证失败

1. 核对依赖版本兼容性 #

Spring Boot 2.7.4 配套的 spring-data-elasticsearch 版本为 4.4.x，官方仅支持 Elasticsearch 7.17.x ~ 8.5.x，你使用的 8.9.2 超出兼容范围，可能导致认证逻辑异常。解决方式：

• 方案一：降级 Elasticsearch 至 8.5.x，保持与 Spring Boot 生态的兼容性。
• 方案二：显式指定 Elasticsearch 客户端版本为 8.9.2，排除 starter 中自带的旧版本依赖（以 Maven 为例）：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-elasticsearch</artifactId>
    <exclusions>
        <exclusion>
            <groupId>org.elasticsearch.client</groupId>
            <artifactId>elasticsearch-rest-client</artifactId>
        </exclusion>
        <exclusion>
            <groupId>org.elasticsearch</groupId>
            <artifactId>elasticsearch</artifactId>
        </exclusion>
    </exclusions>
</dependency>
<dependency>
    <groupId>org.elasticsearch</groupId>
    <artifactId>elasticsearch</artifactId>
    <version>8.9.2</version>
</dependency>
<dependency>
    <groupId>org.elasticsearch.client</groupId>
    <artifactId>elasticsearch-rest-client</artifactId>
    <version>8.9.2</version>
</dependency>
<dependency>
    <groupId>org.elasticsearch.client</groupId>
    <artifactId>elasticsearch-rest-high-level-client</artifactId>
    <version>8.9.2</version>
</dependency>

2. 检查配置文件参数 #

确保 application.yml（或 application.properties）中的认证参数正确，特殊字符需转义：

spring:
  elasticsearch:
    rest:
      uris: http://your-es-host:9200  # 若ES开启HTTPS，需改为https://xxx
      username: your-username
      password: your-password

• 若 Elasticsearch 开启 HTTPS，需添加 SSL 信任配置：

spring:
  elasticsearch:
    rest:
      ssl:
        truststore:
          path: classpath:elastic-ca.p12  # 替换为你的CA证书路径
          password: your-ca-password      # CA证书密码

3. 手动配置认证客户端Bean #

自动配置可能因版本兼容失效，手动创建带基础认证的 RestHighLevelClient：

@Configuration
public class ElasticsearchConfig {

    @Value("${spring.elasticsearch.rest.uris}")
    private String esUris;

    @Value("${spring.elasticsearch.rest.username}")
    private String username;

    @Value("${spring.elasticsearch.rest.password}")
    private String password;

    @Bean
    public RestHighLevelClient restHighLevelClient() {
        CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
        credentialsProvider.setCredentials(AuthScope.ANY,
                new UsernamePasswordCredentials(username, password));

        RestClientBuilder builder = RestClient.builder(HttpHost.create(esUris))
                .setHttpClientConfigCallback(httpClientBuilder ->
                        httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider));

        // 若开启HTTPS，添加SSL信任配置
        // try {
        //     SSLContext sslContext = SSLContexts.custom()
        //             .loadTrustMaterial(new ClassPathResource("elastic-ca.p12").getFile(),
        //                     "your-ca-password".toCharArray())
        //             .build();
        //     builder.setHttpClientConfigCallback(httpClientBuilder ->
        //             httpClientBuilder.setSSLContext(sslContext)
        //                     .setDefaultCredentialsProvider(credentialsProvider));
        // } catch (Exception e) {
        //     throw new RuntimeException("Failed to initialize SSL context", e);
        // }

        return new RestHighLevelClient(builder);
    }
}

4. 验证Elasticsearch用户权限 #

确认所用账号具备必要权限（如 cluster_monitor、read_write），可通过curl验证：

curl -u your-username:your-password http://your-es-host:9200/_security/user/your-username

检查返回的角色列表，确保包含所需权限。

5. 开启日志排查请求细节 #

添加日志配置，查看请求是否正确携带认证头：

logging:
  level:
    org.apache.http: DEBUG
    org.elasticsearch.client: DEBUG

启动应用后，检查日志中是否存在 Authorization: Basic xxx 请求头，若缺失则说明认证参数未被正确加载。

内容的提问来源于stack exchange，提问作者Junior Anthony