tlog-play not reading authentication

[dplookup]

Hello,

I am on Rocky Linux release 9.4 (Blue Onyx) attempting to use tlog play to relplay logs that I ha stored in elasticsearch.

tlog --version = 14

Using command tlog-play -r es --es-baseurl='https://test.hostname/user-logs-2024.08.28/_search' --es-query='session:3' --es-verbose

The command does not seam to read authentication and returns error code 401.

I have tried setting:

• TLOG_CURL_USERPWD env with user:password
• .netrc file with authentication information

If I set .netrc and use curl https://test.hostname/user-logs-2024.08.28/_search the command succeds and returns authentication.

Any ideas on how to solve?

Thanks