This problem occurs because after elasticsearch configures the password, the connection es encounters authentication problems when logstash starts. The solution requires configuring the account password in the logstash configuration file

vim /app/logstash/config/beat_es.conf

input {
   beats {
     port => 5044
   }
}
filter {
    #Only do json parsing on nginx json logs, system messages are in other formats, no need to handle
    if [fields][log_type] == "nginx"{
      json {
         source => "message"
         remove_field => ["beat","offset","tags","prospector"] #Remove fields, no collection required
      }
      date {
        match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] # match the timestamp field
        target => "@timestamp" # write the matched data to the @timestamp field
      }
  }
}
 
output {

       if [fields][log_type] == "ruoyi" {
         elasticsearch {
            hosts => ["node1:9200","node2:9200"]
            user => elastic
            password => "123123"
            index => "ruoyi_log"
            timeout => 300
        }
       }
}