# CreateIndex Pattern Error (forbidden)

**URL:** <https://discuss.elastic.co/t/createindex-pattern-error-forbidden/216404>\
**Category:** Kibana\
**Tags:** ilm-index-lifecycle-management\
**Created:** [January 24, 2020, 11:04am UTC](https://discuss.elastic.co/t/createindex-pattern-error-forbidden/216404 "2020-01-24T11:04:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Barancan\_GENC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/barancan_genc/32/45778_2.png) [@Barancan\_GENC](https://discuss.elastic.co/u/Barancan_GENC)\
**Post date:** [January 24, 2020, 11:04am UTC](https://discuss.elastic.co/t/createindex-pattern-error-forbidden/216404/1 "2020-01-24T11:04:56Z")

</div>

Hi,  
I tried to install elasticsearch and kibana, I installed successfully but when i create index pattern i got this error "forbidden", why i got this error.  
I searched a lot of source of elk but i cant find any solution,  
Please help me how i can resolve this

My Elasticsearch serach yml (config)

```
    # ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: logSample
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: logSample1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
#path.data: /path/to/data
#
# Path to log files:
#
#path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
#network.host: 192.168.0.1
#
# Set a custom port for HTTP:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial_master_nodes: ["node-1", "node-2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true

```

My Kibana yml (Config)

```
    # Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
server.host: "localhost"

# Enables you to specify a path to mount Kibana at if you are running behind a proxy.
# Use the `server.rewriteBasePath` setting to tell Kibana if it should remove the basePath
# from requests it receives, and to prevent a deprecation warning at startup.
# This setting cannot end in a slash.
#server.basePath: ""

# Specifies whether Kibana should rewrite requests that are prefixed with
# `server.basePath` or require that they are rewritten by your reverse proxy.
# This setting was effectively always `false` before Kibana 6.3 and will
# default to `true` starting in Kibana 7.0.
#server.rewriteBasePath: false

# The maximum payload size in bytes for incoming server requests.
#server.maxPayloadBytes: 1048576

# The Kibana server's name. This is used for display purposes.
server.name: "DESKTOP-N4SHLU0"

# The URLs of the Elasticsearch instances to use for all your queries.
elasticsearch.hosts: ["http://localhost:9200"]

# When this setting's value is true Kibana uses the hostname specified in the server.host
# setting. When the value of this setting is false, Kibana uses the hostname of the host
# that connects to this Kibana instance.
#elasticsearch.preserveHost: true

# Kibana uses an index in Elasticsearch to store saved searches, visualizations and
# dashboards. Kibana creates a new index if the index doesn't already exist.
kibana.index: ".kibana"

# The default application to load.
#kibana.defaultAppId: "home"

# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
#elasticsearch.username: "kibana"
#elasticsearch.password: "pass"

# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
# These settings enable SSL for outgoing requests from the Kibana server to the browser.
#server.ssl.enabled: false
#server.ssl.certificate: /path/to/your/server.crt
#server.ssl.key: /path/to/your/server.key

# Optional settings that provide the paths to the PEM-format SSL certificate and key files.
# These files validate that your Elasticsearch backend uses the same key files.
#elasticsearch.ssl.certificate: /path/to/your/client.crt
#elasticsearch.ssl.key: /path/to/your/client.key

# Optional setting that enables you to specify a path to the PEM file for the certificate
# authority for your Elasticsearch instance.
#elasticsearch.ssl.certificateAuthorities: ["/path/to/your/CA.pem"]

# To disregard the validity of SSL certificates, change this setting's value to 'none'.
#elasticsearch.ssl.verificationMode: full

# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of
# the elasticsearch.requestTimeout setting.
#elasticsearch.pingTimeout: 1500

# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value
# must be a positive integer.
#elasticsearch.requestTimeout: 30000

# List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side
# headers, set this value to [] (an empty list).
#elasticsearch.requestHeadersWhitelist: [authorization]

# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten
# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.
#elasticsearch.customHeaders: {}

# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.
#elasticsearch.shardTimeout: 30000

# Time in milliseconds to wait for Elasticsearch at Kibana startup before retrying.
#elasticsearch.startupTimeout: 5000

# Logs queries sent to Elasticsearch. Requires logging.verbose set to true.
#elasticsearch.logQueries: false

# Specifies the path where Kibana creates the process ID file.
#pid.file: /var/run/kibana.pid

# Enables you specify a file where Kibana stores log output.
#logging.dest: stdout

# Set the value of this setting to true to suppress all logging output.
#logging.silent: false

# Set the value of this setting to true to suppress all logging output other than error messages.
#logging.quiet: false

# Set the value of this setting to true to log all events, including system usage information
# and all requests.
#logging.verbose: false

# Set the interval in milliseconds to sample system and process performance
# metrics. Minimum is 100ms. Defaults to 5000.
#ops.interval: 5000

# Specifies locale to be used for all localizable strings, dates and number formats.
# Supported languages are the following: English - en , by default , Chinese - zh-CN .
#i18n.locale: "en"

```

My Elasticsearch

 ![Screenshot_0](https://us1.discourse-cdn.com/elastic/original/3X/3/6/3662b6bcc3dd478cf3191cbcb84adfca2d52e9ac.png)  
My Kibanar start status on powershell  
 ![Screenshot_1](https://us1.discourse-cdn.com/elastic/original/3X/9/1/91909d49a13cd17705b7547076083d7f2c826933.png)  
I open kibana and click visualize  
 ![Screenshot_2](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d3be5d94a297914ff533def67ebde0bbf2ce6a40.png)  
I find my indexies(log records) and i clicked Next Step  
 ![Screenshot_3](https://us1.discourse-cdn.com/elastic/original/3X/0/5/0554b031e0c7dbdf89dc8c56c021f1028a77ee1b.png)  
I choose any option like @timstamp and clicked Create index pattern  
 ![Screenshot_4](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c7b2725c501593b4715243063d49f18f2ee9f3cb.png)  
I got this error message  
 ![Screenshot_5](https://us1.discourse-cdn.com/elastic/original/3X/b/e/be3577732ba2eb2d6145bd8ac6fe47ba15607965.png)

---

<div class="post-metadata">

**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\
**Post date:** [January 24, 2020, 12:19pm UTC](https://discuss.elastic.co/t/createindex-pattern-error-forbidden/216404/2 "2020-01-24T12:19:19Z")

</div>

Hi,

Looks like your user doesn't have enough permissions to create an index pattern:

- what roles does your user have?
- what version of the Elastic stack do you use?
- can you share HAR or at least see which API request fails with 403 error when you try to save index pattern (Network tab in browser Dev tools)
- If you can enable verbose logging in Kibana and share the logs, from Kibana start up to the point when this error happens

Best,  
Oleg

---

<div class="post-metadata">

**Author:** ![Barancan\_GENC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/barancan_genc/32/45778_2.png) [@Barancan\_GENC](https://discuss.elastic.co/u/Barancan_GENC)\
**Post date:** [January 27, 2020, 11:25am UTC](https://discuss.elastic.co/t/createindex-pattern-error-forbidden/216404/3 "2020-01-27T11:25:16Z")

</div>

My User is admin  
My ELK version 7.5.1

ELK ALL log

```
[2020-01-27T12:42:37,144][WARN][o.e.c.r.a.DiskThresholdMonitor] [logSample1] flood stage disk watermark [95%] exceeded on [3c4RUP16TVGiQ13bPk4K1Q][logSample1][C:\elasticsearch-7.5.1-windows-x86_64\elasticsearch-7.5.1\data\nodes\0] free: 2.5gb[1.1%], all indices on this node will be marked read-only
[2020-01-27T12:42:37,159][INFO][o.e.x.m.MlDailyMaintenanceService] [logSample1] triggering scheduled [ML] maintenance tasks
[2020-01-27T12:42:39,796][INFO][o.e.x.m.a.TransportDeleteExpiredDataAction] [logSample1] Deleting expired data
[2020-01-27T12:42:40,472][INFO][o.e.x.m.a.TransportDeleteExpiredDataAction] [logSample1] Completed deletion of expired ML data
[2020-01-27T12:42:40,476][INFO][o.e.x.m.MlDailyMaintenanceService] [logSample1] Successfully completed [ML] maintenance tasks
[2020-01-27T12:43:09,693][WARN][o.e.c.r.a.DiskThresholdMonitor] [logSample1] flood stage disk watermark [95%] exceeded on [3c4RUP16TVGiQ13bPk4K1Q][logSample1][C:\elasticsearch-7.5.1-windows-x86_64\elasticsearch-7.5.1\data\nodes\0] free: 2.4gb[1.1%], all indices on this node will be marked read-only
[2020-01-27T12:43:39,700][WARN][o.e.c.r.a.DiskThresholdMonitor] [logSample1] flood stage disk watermark [95%] exceeded on [3c4RUP16TVGiQ13bPk4K1Q][logSample1][C:\elasticsearch-7.5.1-windows-x86_64\elasticsearch-7.5.1\data\nodes\0] free: 2.5gb[1.2%], all indices on this node will be marked read-only
[2020-01-27T12:44:09,718][WARN][o.e.c.r.a.DiskThresholdMonitor] [logSample1] flood stage disk watermark [95%] exceeded on [3c4RUP16TVGiQ13bPk4K1Q][logSample1][C:\elasticsearch-7.5.1-windows-x86_64\elasticsearch-7.5.1\data\nodes\0] free: 2.5gb[1.1%], all indices on this node will be marked read-only
[2020-01-27T12:44:39,723][WARN][o.e.c.r.a.DiskThresholdMonitor] [logSample1] flood stage disk watermark [95%] exceeded on [3c4RUP16TVGiQ13bPk4K1Q][logSample1][C:\elasticsearch-7.5.1-windows-x86_64\elasticsearch-7.5.1\data\nodes\0] free: 2.5gb[1.1%], all indices on this node will be marked read-only
[2020-01-27T12:45:09,727][WARN][o.e.c.r.a.DiskThresholdMonitor] [logSample1] flood stage disk watermark [95%] exceeded on [3c4RUP16TVGiQ13bPk4K1Q][logSample1][C:\elasticsearch-7.5.1-windows-x86_64\elasticsearch-7.5.1\data\nodes\0] free: 2.5gb[1.1%], all indices on this node will be marked read-only
[2020-01-27T12:45:39,731][WARN][o.e.c.r.a.DiskThresholdMonitor] [logSample1] flood stage disk watermark [95%] exceeded on [3c4RUP16TVGiQ13bPk4K1Q][logSample1][C:\elasticsearch-7.5.1-windows-x86_64\elasticsearch-7.5.1\data\nodes\0] free: 2.5gb[1.1%], all indices on this node will be marked read-only
[2020-01-27T12:46:09,734][WARN][o.e.c.r.a.DiskThresholdMonitor] [logSample1] flood stage disk watermark [95%] exceeded on [3c4RUP16TVGiQ13bPk4K1Q][logSample1][C:\elasticsearch-7.5.1-windows-x86_64\elasticsearch-7.5.1\data\nodes\0] free: 2.5gb[1.1%], all indices on this node will be marked read-only
[2020-01-27T12:46:39,780][WARN][o.e.c.r.a.DiskThresholdMonitor] [logSample1] flood stage disk watermark [95%] exceeded on [3c4RUP16TVGiQ13bPk4K1Q][logSample1][C:\elasticsearch-7.5.1-windows-x86_64\elasticsearch-7.5.1\data\nodes\0] free: 2.3gb[1.1%], all indices on this node will be marked read-only

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/2/420cf485448a9277b87705274678ce5fe283a0e2.png)

I Cant find kibana log

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [January 28, 2020, 2:50pm UTC](https://discuss.elastic.co/t/createindex-pattern-error-forbidden/216404/4 "2020-01-28T14:50:03Z")

</div>

Can you post the result of the get\_user API call for your user?  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-user.hAlso](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-user.hAlso), make sure that you also have the "kibana\_user" role assigned to that user.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2020, 2:50pm UTC](https://discuss.elastic.co/t/createindex-pattern-error-forbidden/216404/5 "2020-02-25T14:50:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.