# 401 "unauthorised" error in Filebeat

**URL:** <https://discuss.elastic.co/t/401-unauthorised-error-in-filebeat/74488>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 9, 2017, 11:00am UTC](https://discuss.elastic.co/t/401-unauthorised-error-in-filebeat/74488 "2017-02-09T11:00:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![111148](https://avatars.discourse-cdn.com/v4/letter/1/eb8c5e/32.png) [@111148](https://discuss.elastic.co/u/111148)\
**Post date:** [February 9, 2017, 11:00am UTC](https://discuss.elastic.co/t/401-unauthorised-error-in-filebeat/74488/1 "2017-02-09T11:00:20Z")

</div>

Hello,  
I am trying to load template for Kibana in Filebeat

PS C:\filebeat-5.2.0-windows-x86\_64\scripts\> .\import\_dashboards.exe -file .\beats-dashboards-5.2.0.zip.\import\_dashboards.exe -file .\beats-dashboards-5.2.0.zip

but facing with error:

fail to set the mapping. Error: 401 Unauthorized  
Create temporary directory C:\TEMP\2\tmp138444715  
Unzip archive C:\TEMP\2\tmp138444715  
C:\TEMP\2\tmp138444715\beats-dashboards-5.2.0\filebeat  
Import directory C:\TEMP\2\tmp138444715\beats-dashboards-5.2.0\filebeat/index-pattern  
Import index to /.kibana/index-pattern/filebeat-\* from C:\TEMP\2\tmp138444715\beats-dashboards-5.2.0\filebeat\index-pattern\filebeat.json  
ERROR: couldn't load json. Error: 401 Unauthorized  
fail to import index-pattern: fail to load directory C:\TEMP\2\tmp138444715\beats-dashboards-5.2.0\filebeat/index-pattern: error loading C:\TEMP\2\tmp138444715\beats-dashboards-5.2.0\filebeat\index-pattern\filebeat.json: couldn't load json. Error: 401 Unauthorized

Please advise what i am doing wrong. I am using x-pack and all my yml and config files include username and password mentioned for "elastic" default user.

Thanks.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 9, 2017, 1:58pm UTC](https://discuss.elastic.co/t/401-unauthorised-error-in-filebeat/74488/2 "2017-02-09T13:58:55Z")

</div>

You must set the `-user` and `-pass` flags. See `.\import_dashboards.exe -h`. It doesn't read the YAML config file.

---

<div class="post-metadata">

**Author:** ![111148](https://avatars.discourse-cdn.com/v4/letter/1/eb8c5e/32.png) [@111148](https://discuss.elastic.co/u/111148)\
**Post date:** [February 9, 2017, 11:44pm UTC](https://discuss.elastic.co/t/401-unauthorised-error-in-filebeat/74488/3 "2017-02-09T23:44:10Z")

</div>

PS C:\filebeat-5.2.0-windows-x86\_64\scripts\> .\import\_dashboards.exe -user ..... -pass .......... -file .\beats-dashboards-5.2.0.zip  
Create temporary directory C:\Users\bb\_admin\AppData\Local\Temp\2\tmp510701671  
Unzip archive C:\Users\bb\_admin\AppData\Local\Temp\2\tmp510701671  
C:\Users\bb\_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\filebeat  
Import directory C:\Users\bb\_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\filebeat/index-pattern  
Import index to /.kibana/index-pattern/filebeat-\* from C:\Users\bb\_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\filebeat\index-pattern\filebeat.json  
**No directory C:\Users\bb\_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\filebeat/dashboard**  
C:\Users\bb\_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\heartbeat  
C:\Users\bb\_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\metricbeat  
C:\Users\bb\_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\packetbeat  
C:\Users\bb\_admin\AppData\Local\Temp\2\tmp510701671\beats-dashboards-5.2.0\winlogbeat  
PS C:\filebeat-5.2.0-windows-x86\_64\scripts\>

i am starting this command under the local admin account.  
also have disabled checkbox "read only" for temp dirrectory.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 9, 2017, 11:59pm UTC](https://discuss.elastic.co/t/401-unauthorised-error-in-filebeat/74488/4 "2017-02-09T23:59:07Z")

</div>

That looks normal. There is only an index pattern for Filebeat. There are no sample dashboards since people's logs vary so much.

But we are working on a new feature to bundle configuration for parsing common log types with dashboards designed specifically for those logs types. We are calling it Filebeat modules.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2017, 12:02am UTC](https://discuss.elastic.co/t/401-unauthorised-error-in-filebeat/74488/7 "2017-03-10T00:02:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.