# Beat setup dashboards don't work in different spaces **URL:** \ **Category:** Kibana\ **Tags:** docker\ **Created:** [November 12, 2023, 10:53am UTC](https://discuss.elastic.co/t/beat-setup-dashboards-dont-work-in-different-spaces/346925 "2023-11-12T10:53:47Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![litsegaard](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/litsegaard/32/126548_2.png) [@litsegaard](https://discuss.elastic.co/u/litsegaard)\ **Post date:** [November 12, 2023, 10:53am UTC](https://discuss.elastic.co/t/beat-setup-dashboards-dont-work-in-different-spaces/346925/1 "2023-11-12T10:53:47Z")
I'm running the 8.10.4 stack and having trouble settings up the dashboards for various beats. I run a simple setup command using Docker and all the dashboards for a given beat are imported. However, when clicking a link in, say, `Sudo commands` in the `Filebeat System] Syslog dashboard ECS` dashboard in a space which is _not_ default, I'm greeted by the `"The requested dashboard could not be found."` error. The setup command does not report any error and all dashboards are imported into my space. It's just the links that are completely broken. The setup command I use is: ```auto docker run --net="host" docker.elastic.co/beats/filebeat:8.10.4 setup \ -E setup.kibana.host=... \ -E setup.kibana.username=... \ -E setup.kibana.password=... \ -E setup.kibana.space.id=admins \ --dashboards ``` The _only_ space where the imported dashboards work as advertised is in the "Default" space. The link in the respective space in this case is: Default: .../app/dashboards#/dashboard/277876d0-fa2c-11e6-bbd3-29c986c96e5a-ecs Admins: .../s/admins/app/dashboards#/dashboard/277876d0-fa2c-11e6-bbd3-29c986c96e5a-ecs Admins is the space I'm trying to setup the dashboards in. What am I doing wrong here? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 12, 2023, 3:49pm UTC](https://discuss.elastic.co/t/beat-setup-dashboards-dont-work-in-different-spaces/346925/2 "2023-11-12T15:49:28Z")
Hi @litsegaard Try Running without the `--dashboards` if you do this only the dashboards get loaded to that space there are other assets that are needed... specifically the template and dataview that are needed for the dashboards. In general I always recommend just running `setup -e` without any other args, that way all the needed assets are loaded. When I ran as you did... same issues... when I ran without the `--dashboards` i.e. load all assets it worked. ![Screenshot 2023-11-12 at 7.50.24 AM](https://us1.discourse-cdn.com/elastic/original/3X/f/0/f0bd8215a1305713eb01b82ad8f5c17247dfca36.png) ---
**Author:** ![litsegaard](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/litsegaard/32/126548_2.png) [@litsegaard](https://discuss.elastic.co/u/litsegaard)\ **Post date:** [November 13, 2023, 8:42am UTC](https://discuss.elastic.co/t/beat-setup-dashboards-dont-work-in-different-spaces/346925/3 "2023-11-13T08:42:53Z")
> [@litsegaard](#): > > ```auto > docker run --net="host" docker.elastic.co/beats/filebeat:8.10.4 setup \ > -E setup.kibana.host=... \ > -E setup.kibana.username=... \ > -E setup.kibana.password=... \ > -E setup.kibana.space.id=admins \ > --dashboards > > ``` Hi Stephen! First many thanks for your reply. However, setup -e did not solve the issue for me. All index templates, the data view, index templates and dashboards+viz were successfully imported but the original error remains the same. All of the imported objects were correctly imported into the space ("admins" in this case) BUT as soon as I click 'Sudo commands' for example in the syslog dashboard (admins space) I get an angry "The requested dashboard could not be found." error. I currently have six spaces for various tenants but only "Default" is working. There must be something else going on here... ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 13, 2023, 2:54pm UTC](https://discuss.elastic.co/t/beat-setup-dashboards-dont-work-in-different-spaces/346925/4 "2023-11-13T14:54:33Z")
Sorry confused. Did you take out the `--dashboards` ```auto docker run --net="host" docker.elastic.co/beats/filebeat:8.10.4 setup \ -E setup.kibana.host=... \ -E setup.kibana.username=... \ -E setup.kibana.password=... \ -E setup.kibana.space.id=admins ``` Does the user you are running setup as have permission to write to this spaces? I don't have an answer for you as I cannot repeat what you're seeing on my side because it's working fine. ---
**Author:** ![petlit2049](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@petlit2049](https://discuss.elastic.co/u/petlit2049)\ **Post date:** [November 14, 2023, 6:31am UTC](https://discuss.elastic.co/t/beat-setup-dashboards-dont-work-in-different-spaces/346925/5 "2023-11-14T06:31:42Z")
Hi Stephen! (This is me as well - just another account 😀 ) Affirmative: I just executed 'setup -e' using the 'elastic' super user. It's correct that other users have very limited access to the other spaces as each tenant has a specific role, but I thought the 'elastic' user still had full access to the search/kibana functionality. Everything seems to be imported (dashboards, visualizations, index templates, data view, pipelines...) no errors there, but even if I login using the 'elastic' user and select _any_ other space but 'Default' I have these issues. It is very odd. Hmmmm, may I ask which user you are using for the beats setup? Are you using, say, a 'filebeat/audit/packet...-setup' (filebeat-setup, auditbeat-setup...) user or are you using 'elastic' as me? I thought (wrongly?) that 'elastic' could do whatever in the cluster having all as a cluster priv but this might be a wrong reasoning by me? The dashboards/visualizations etc are indeed installed in the respective space - it's just the links between dashboards that fail if I'm in a space which is not 'Default'. I hope this makes sense... ---
**Author:** ![petlit2049](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@petlit2049](https://discuss.elastic.co/u/petlit2049)\ **Post date:** [November 14, 2023, 11:26am UTC](https://discuss.elastic.co/t/beat-setup-dashboards-dont-work-in-different-spaces/346925/7 "2023-11-14T11:26:01Z")
Hi Stephen! Thanks for helping me sort this out! Allow me to describe what I've done for one of my tenants that fails to work as intended and let's focus on the Filebeat integration: I've created the following roles (pseudo code): ```auto filebeat_setup cluster privs: [monitor, manage_ilm] indices privs: [filebeat-* : manage] ``` ```auto filebeat_reader cluster privs: [monitor] indices privs: [filebeat-* : read] ``` ```auto filebeat_writer cluster privs: [monitor, read_ilm, read_pipeline] indices privs: [filebeat-* : create_doc] ``` I have established one role/tenant and a sample tenant role looks like this: role "tenant x" having the following privileges: ```auto tenant x cluster privs: none indices privs: [filebeat-* : read, "tenant indices": all] tenant x space: [ Discover : all, Dashboard: all, Visualize: all ] ``` Finally, I have a tenant user x with the following privileges: `Privileges: tenant x, filebeat_reader` I use filebeat\_setup to setup all Filebeat related artefacts in my cluster. Although all artefacts are imported I'm unable to follow dashboards links. A click on the "Raw Flow Records" in the "Filebeat Net Flow" dashboard, for example, gives a 404 error. If I look in the saved objects section I can see all imported dashboards and visualizations but they're not "clickable"by my tenant user x. There must be a Space feature and/or privilege I'm missiong somewhere but I'm out of luck identifying which... ☹ ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 14, 2023, 3:10pm UTC](https://discuss.elastic.co/t/beat-setup-dashboards-dont-work-in-different-spaces/346925/8 "2023-11-14T15:10:04Z")
What happens if you log in as elastic super user then go to that tenant space do the dashboards work? ---
**Author:** ![petlit2049](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@petlit2049](https://discuss.elastic.co/u/petlit2049)\ **Post date:** [November 15, 2023, 6:22am UTC](https://discuss.elastic.co/t/beat-setup-dashboards-dont-work-in-different-spaces/346925/9 "2023-11-15T06:22:19Z")
I still experience problems. Let me give you some additional info here. The initial (Filebeat setup in this case) has been done like this: ```auto docker run --net="host" \ -v .../ca.crt:/usr/share/filebeat/ca.crt \ docker.elastic.co/beats/filebeat:8.10.4 \ setup -e \ -E setup.kibana.username=filebeat_setup \ -E setup.kibana.password=... \ -E setup.kibana.host="http://localhost:5601" \ -E output.elasticsearch.username=filebeat_setup \ -E output.elasticsearch.password=... \ -E output.elasticsearch.hosts=["https://localhost:9200"] \ -E output.elasticsearch.ssl.certificate_authorities=["/usr/share/filebeat/ca.crt"] ``` This command seems to work fine and I get no errors. After this I issue the following for the other tenants: ```auto docker run --net="host" \ -v .../ca.crt:/usr/share/filebeat/ca.crt \ docker.elastic.co/beats/filebeat:8.10.4 \ setup --dashboards \ -E setup.kibana.username=filebeat_setup \ -E setup.kibana.password=... \ -E setup.kibana.host="http://localhost:5601" \ -E setup.kibana.space.id= \ -E output.elasticsearch.username=filebeat_setup \ -E output.elasticsearch.password=... \ -E output.elasticsearch.hosts=["https://localhost:9200"] \ -E output.elasticsearch.ssl.certificate_authorities=["/usr/share/filebeat/ca.crt"] ``` Again the command executes without any errors. Now, if log in as a user of the "admins" role I may access (say the Filebeat Syslog) dashboard and click the links. However, if i switch to the "tenant x" space, select the same dashboard and then click the links, I get a 404 error. If I log in as a member of the "tenant x" space, go to the same dashboard as the above, I can open the dashboard but clicking any of the links result int oa 404 error. I think this shows that I must have done something wrong in my (ansible) setup. The members of the "admins" role have _all_ cluter privileges and the following Kibana features enabled for the "admins" space (sorry for the long yaml layout): ```auto kibana: features: - feature: enterpriseSearch privileges: - all - feature: discover privileges: - all - feature: dashboard privileges: - all - feature: canvas privileges: - all - feature: maps privileges: - all - feature: ml privileges: - all - feature: logs privileges: - all - feature: graph privileges: - all - feature: visualize privileges: - all - feature: infrastructure privileges: - all - feature: apm privileges: - all - feature: uptime privileges: - all - feature: siem privileges: - all - feature: securitySolutionCases privileges: - all - feature: slo privileges: - all - feature: dev_tools privileges: - all - feature: advancedSettings privileges: - all - feature: indexPatterns privileges: - all - feature: fileManagement privileges: - all - feature: filesSharedImage privileges: - all - feature: savedObjectsManagement privileges: - all - feature: savedObjectsTagging privileges: - all - feature: osquery privileges: - none - feature: actions privileges: - all - feature: generalCases privileges: - all - feature: guidedOnboardingFeature privileges: - all - feature: monitoring privileges: - all - monitoring_user spaces: - space: admins ``` The "tenant x" users have no cluster privileges and the following Kibana features: ```auto kibana: features: - feature: enterpriseSearch privileges: - none - feature: discover privileges: - all - feature: dashboard privileges: - all - feature: canvas privileges: - none - feature: maps privileges: - none - feature: ml privileges: - none - feature: logs privileges: - none - feature: graph privileges: - none - feature: visualize privileges: - all - feature: infrastructure privileges: - none - feature: apm privileges: - none - feature: uptime privileges: - none - feature: siem privileges: - none - feature: securitySolutionCases privileges: - none - feature: slo privileges: - none - feature: dev_tools privileges: - none - feature: advancedSettings privileges: - none - feature: indexPatterns privileges: - all - feature: fileManagement privileges: - none - feature: filesSharedImage privileges: - none - feature: savedObjectsManagement privileges: - none - feature: savedObjectsTagging privileges: - none - feature: osquery privileges: - none - feature: actions privileges: - none - feature: generalCases privileges: - none - feature: guidedOnboardingFeature privileges: - none spaces: - space: ``` Currently I'm out of luck understanding what's going on "under the hood" but it feels like I must have missed something in the Kibana sections above _or_ a cluster/kibana privilege. Again, many thanks for looking into this! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 15, 2023, 6:54am UTC](https://discuss.elastic.co/t/beat-setup-dashboards-dont-work-in-different-spaces/346925/10 "2023-11-15T06:54:31Z")
I can't debug all your combinations... If I were you I run this against each space / tenant ```auto docker run --net="host" \ -v .../ca.crt:/usr/share/filebeat/ca.crt \ docker.elastic.co/beats/filebeat:8.10.4 \ setup -e \ -E setup.kibana.username=filebeat_setup \ -E setup.kibana.password=... \ -E setup.kibana.host="http://localhost:5601" \ -E output.elasticsearch.username=filebeat_setup \ -E output.elasticsearch.password=... \ -E setup.kibana.space.id= \