401 "unauthorised" error in Filebeat

[111148 (Костя Хомко)]

Hello,
I am trying to load template for Kibana in Filebeat

PS C:\filebeat-5.2.0-windows-x86_64\scripts> .\import_dashboards.exe -file .\beats-dashboards-5.2.0.zip.\import_dashboards.exe -file .\beats-dashboards-5.2.0.zip

but facing with error:

fail to set the mapping. Error: 401 Unauthorized
Create temporary directory C:\TEMP\2\tmp138444715
Unzip archive C:\TEMP\2\tmp138444715
C:\TEMP\2\tmp138444715\beats-dashboards-5.2.0\filebeat
Import directory C:\TEMP\2\tmp138444715\beats-dashboards-5.2.0\filebeat/index-pattern
Import index to /.kibana/index-pattern/filebeat-* from C:\TEMP\2\tmp138444715\beats-dashboards-5.2.0\filebeat\index-pattern\filebeat.json
ERROR: couldn't load json. Error: 401 Unauthorized
fail to import index-pattern: fail to load directory C:\TEMP\2\tmp138444715\beats-dashboards-5.2.0\filebeat/index-pattern: error loading C:\TEMP\2\tmp138444715\beats-dashboards-5.2.0\filebeat\index-pattern\filebeat.json: couldn't load json. Error: 401 Unauthorized

Please advise what i am doing wrong. I am using x-pack and all my yml and config files include username and password mentioned for "elastic" default user.

Thanks.

[andrewkroh]

You must set the -user and -pass flags. See .\import_dashboards.exe -h. It doesn't read the YAML config file.

[111148 (Костя Хомко)]

PS C:\filebeat-5.2.0-windows-x86_64\scripts> .\import_dashboards.exe -user ..... -pass .......... -file .\beats-dashboards-5.2.0.zip
Create temporary directory C:\Users\bb_admin\AppData\Local\Temp\2\tmp510701671
Unzip archive C:\Users\bb_admin\AppData\Local\Temp\2\tmp510701671
C:\Users\bb_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\filebeat
Import directory C:\Users\bb_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\filebeat/index-pattern
Import index to /.kibana/index-pattern/filebeat-* from C:\Users\bb_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\filebeat\index-pattern\filebeat.json
No directory C:\Users\bb_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\filebeat/dashboard
C:\Users\bb_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\heartbeat
C:\Users\bb_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\metricbeat
C:\Users\bb_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\packetbeat
C:\Users\bb_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\winlogbeat
PS C:\filebeat-5.2.0-windows-x86_64\scripts>

i am starting this command under the local admin account.
also have disabled checkbox "read only" for temp dirrectory.

[andrewkroh]

That looks normal. There is only an index pattern for Filebeat. There are no sample dashboards since people's logs vary so much.

But we are working on a new feature to bundle configuration for parsing common log types with dashboards designed specifically for those logs types. We are calling it Filebeat modules.