# Auditbeat vs testing ES output

**URL:** <https://discuss.elastic.co/t/auditbeat-vs-testing-es-output/221252>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [February 27, 2020, 2:24pm UTC](https://discuss.elastic.co/t/auditbeat-vs-testing-es-output/221252 "2020-02-27T14:24:15Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [March 3, 2020, 7:53am UTC](https://discuss.elastic.co/t/auditbeat-vs-testing-es-output/221252/4 "2020-03-03T07:53:43Z")

</div>

Anyone?

'Service unavailable' wouldn't that possible imply some kind of permission issue on elastic side, and if how to get details logged somehow?

I'm puzzled by this, user attempted with has a role which got create\_index,index,write on auditbeat-\* same role which work for another user working for Windows auditbeats.

---

_[View the full topic](https://discuss.elastic.co/t/auditbeat-vs-testing-es-output/221252)._