# Error: 403 Forbidden while trying to Create IndexPattern for filebeat. Tried Most of The Solutions!

**URL:** <https://discuss.elastic.co/t/error-403-forbidden-while-trying-to-create-indexpattern-for-filebeat-tried-most-of-the-solutions/172182>\
**Category:** Kibana\
**Created:** [March 13, 2019, 4:18pm UTC](https://discuss.elastic.co/t/error-403-forbidden-while-trying-to-create-indexpattern-for-filebeat-tried-most-of-the-solutions/172182 "2019-03-13T16:18:24Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![ishashank](https://avatars.discourse-cdn.com/v4/letter/i/6f9a4e/32.png) [@ishashank](https://discuss.elastic.co/u/ishashank)\
**Post date:** [March 13, 2019, 4:18pm UTC](https://discuss.elastic.co/t/error-403-forbidden-while-trying-to-create-indexpattern-for-filebeat-tried-most-of-the-solutions/172182/1 "2019-03-13T16:18:24Z")

</div>

Hi All,

I've gone through many posts regarding this and still couldn't manage to fix the issue.  
Below are the details of the environment and the index details:

A Clean Installation of ELK followed steps mentioned on:

> **[How To Install Elasticsearch, Logstash, and Kibana (Elastic Stack) on CentOS 7...](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-centos-7)**
>
> In this tutorial for CentOS 7, you will learn how to install all of the components of the Elastic Stack, a collection of open-source software produced by Elastic which allows you to search, analyze, and visualize logs generated from any source in any

The only thing changed is instead of Nginx I'm using apache.

Operating System: CentOS 7

ELK Versions:  
Elasticsearch 6.5.2,  
Kibana 6.6.2,  
Logstash 6.5.2, and  
Filebeat 6.5.2

Current Disk Usage

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a035722621b37f6e8a5a51919160754b0e7e29f.png)

* * *

The Issue:  
Getting the error while trying to Create an Index pattern from the index filebeat-\*  
this filebeat is reading syslog on the server.

Request URL: [https://MyHostName/kibana/api/saved\_objects/index-pattern/015d2500-45a6-11e9-98dd-49be5a77d05f](https://MyHostName/kibana/api/saved_objects/index-pattern/015d2500-45a6-11e9-98dd-49be5a77d05f)  
Request method:PUT

Response: 403 Forbidden

Error on the Kibana Page While trying to Create the index pattern based on filebeat-\* :

Error: Forbidden  
KFetchError@[https://MyHostName/kibana/bundles/commons.bundle.js:3:1049083](https://MyHostName/kibana/bundles/commons.bundle.js:3:1049083)  
kfetch/\</\</promise\</\</\</\<@[https://MyHostName/kibana/bundles/commons.bundle.js:3:504592](https://MyHostName/kibana/bundles/commons.bundle.js:3:504592)  
step@[https://MyHostName/kibana/dlls/vendors.bundle.dll.js:524:4010](https://MyHostName/kibana/dlls/vendors.bundle.dll.js:524:4010)  
verb/\<@[https://MyHostName/kibana/dlls/vendors.bundle.dll.js:524:3275](https://MyHostName/kibana/dlls/vendors.bundle.dll.js:524:3275)  
fulfilled@[https://MyHostName/kibana/dlls/vendors.bundle.dll.js:524:2659](https://MyHostName/kibana/dlls/vendors.bundle.dll.js:524:2659)  
run@[https://MyHostName/kibana/dlls/vendors.bundle.dll.js:212:1730377](https://MyHostName/kibana/dlls/vendors.bundle.dll.js:212:1730377)  
notify/\<@[https://MyHostName/kibana/dlls/vendors.bundle.dll.js:212:1730664](https://MyHostName/kibana/dlls/vendors.bundle.dll.js:212:1730664)  
flush@[https://MyHostName/kibana/dlls/vendors.bundle.dll.js:212:1737402](https://MyHostName/kibana/dlls/vendors.bundle.dll.js:212:1737402)

* * *

Result of  
GET \_cat/indices

green open filebeat-6.6.2-2019.02.14 pUpM-pXlQ2ixX\_9vZgpBoA 3 0 6614 0 1.5mb 1.5mb  
green open filebeat-6.6.2-2019.03.13 gO2BFT98QdWzp2pn856V0Q 3 0 50654 0 14.1mb 14.1mb  
green open filebeat-6.6.2-2019.03.04 8hloDqutSaq139iH6XiX9w 3 0 12295 0 3.8mb 3.8mb  
green open filebeat-6.6.2-2019.02.19 nydUtpbJQsGaeRjvTGb-JA 3 0 6876 0 1.5mb 1.5mb  
green open filebeat-6.6.2-2019.02.11 ne0d4v0wSvu13MGK83pJcg 3 0 6107 0 1.7mb 1.7mb  
green open filebeat-6.6.2-2019.03.12 uh6kt0-BQkOoJIkreRVc3A 3 0 44722 0 9.3mb 9.3mb  
green open filebeat-6.6.2-2019.02.20 GfbEXMb8SiS6KjyMu7rOGg 3 0 36500 0 7.3mb 7.3mb  
green open kibana\_sample\_data\_logs G0NfXAzATEifUTyKA7p91A 1 0 14005 0 11.3mb 11.3mb  
green open filebeat-6.6.2-2019.02.26 \_onWs8UCT1GzEWLoQej3jw 3 0 8244 0 1.9mb 1.9mb  
green open filebeat-6.6.2-2019.03.01 a6RpEeiwRyGhy0nTRgLnAg 3 0 10855 0 2.8mb 2.8mb  
green open .kibana\_1 sFxKdpFtT9CSnHUumOaCsw 1 0 4 0 17.7kb 17.7kb  
green open filebeat-6.6.2-2019.03.06 -AbS-8NaQim4YzDdATLAMg 3 0 8234 0 2.5mb 2.5mb  
green open filebeat-6.6.2-2019.02.18 cOXjWDB5Sx-Lt9TtW26OZA 3 0 8428 0 1.9mb 1.9mb  
green open filebeat-6.6.2-2019.02.12 aSLfIaezQTadVEEQmDp98w 3 0 6109 0 1.3mb 1.3mb  
green open filebeat-6.6.2-2019.02.21 6A-dGRpSThWhk5RyhM4EqA 3 0 18085 0 3.5mb 3.5mb  
green open filebeat-6.6.2-2019.02.28 sZ0hcMkJQhGFfLDo4zuylQ 3 0 9302 0 2.6mb 2.6mb  
green open filebeat-6.6.2-2019.02.13 \_mvPMqyGTdy-GYxhtZk\_fQ 3 0 7858 0 1.8mb 1.8mb  
green open filebeat-6.6.2-2019.02.15 b3\_jSYs6RY6vUAtSJY\_0YQ 3 0 6514 0 1.4mb 1.4mb  
green open filebeat-6.6.2-2019.03.08 kBs7XMQlTYam2FtxCXuOLw 3 0 7839 0 1.6mb 1.6mb  
green open filebeat-6.6.2-2019.03.07 CUNEyP1eQt2Nqjnhb0AdYQ 3 0 9140 0 2.7mb 2.7mb  
green open filebeat-6.6.2-2019.02.22 5ZdEOL6UTDebLhG5PnICCw 3 0 7201 0 1.4mb 1.4mb  
green open filebeat-6.6.2-2019.03.11 EeUP-GP1TPiXIG39ONKp-w 3 0 7274 0 1.6mb 1.6mb  
green open filebeat-6.6.2-2019.02.27 hANjUnRURsCB5hrdamfpTg 3 0 5901 0 1.2mb 1.2mb  
green open filebeat-6.6.2-2019.02.25 1OC7RGozQsGYVRY4Fg2CuA 3 0 5636 0 1.6mb 1.6mb  
green open filebeat-6.6.2-2019.03.05 ana6-PKJSRS5Egak7yEMmQ 3 0 17687 0 7.1mb 7.1mb

`--------------------------------------------------------------------------------------

```
Result of : 
POST .kibana/_search
{
  "size": 10000,
  "from": 0,
  "_source": ["index-pattern.title", "type", "title"],
  "version": true,
  "query": {
    "bool": {
      "filter": [{
        "term": {
          "type": "index-pattern"
        }
      }]
    }
  }
} 

Result:

    {
      "took" : 0,
      "timed_out" : false,
      "_shards" : {
        "total" : 1,
        "successful" : 1,
        "skipped" : 0,
        "failed" : 0
      },
      "hits" : {
        "total" : 1,
        "max_score" : 0.0,
        "hits" : [
          {
            "_index" : ".kibana_1",
            "_type" : "doc",
            "_id" : "index-pattern:015d2500-45a6-11e9-98dd-49be5a77d05f",
            "_version" : 1,
            "_score" : 0.0,
            "_source" : {
              "index-pattern" : {
                "title" : "filebeat-*"
              },
              "type" : "index-pattern"
            }
          }
        ]
      }
    }
    ------------------------------------------------------------------------------------------------------

    Tried Already: 

     PUT _settings
        {
        "index": {
        "blocks": {
        "read_only_allow_delete": "false"
        }
        }
        }

AND 

 PUT filebeat-*
    {
    "index": {
    "blocks": {
    "read_only_allow_delete": "false"
    }
    }
    }

AND 

DELETE kibana*

AND 
curl -XPUT -H "Content-Type: application/json" https://[YOUR_ELASTICSEARCH_ENDPOINT]:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}' 

AND 

sudo filebeat setup --dashboards

```

Still same issue.

Something that might be little different (follwed the commands on the ref. installation Page mentioned above) :  
sudo filebeat setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]'

```
    sudo filebeat setup -e -E output.logstash.enabled=false -E output.elasticsearch.hosts=['localhost:9200'] -E setup.kibana.host=localhost:5601 

```

Please any help is most welcome.

---

<div class="post-metadata">

**Author:** ![cufflinks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cufflinks/32/42129_2.png) [@cufflinks](https://discuss.elastic.co/u/cufflinks)\
**Post date:** [March 13, 2019, 9:10pm UTC](https://discuss.elastic.co/t/error-403-forbidden-while-trying-to-create-indexpattern-for-filebeat-tried-most-of-the-solutions/172182/2 "2019-03-13T21:10:36Z")

</div>

Hello Shashank,

The 403 error might be indicative of a permissions issue. You need both read/write access for the setup command to be able to install what it needs. Do you have read/write access?

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [March 13, 2019, 10:41pm UTC](https://discuss.elastic.co/t/error-403-forbidden-while-trying-to-create-indexpattern-for-filebeat-tried-most-of-the-solutions/172182/3 "2019-03-13T22:41:41Z")

</div>

> [@ishashank](#):
>
> Request URL: [https://MyHostName/kibana/api/saved\_objects/index-pattern/015d2500-45a6-11e9-98dd-49be5a77d05f](https://MyHostName/kibana/api/saved_objects/index-pattern/015d2500-45a6-11e9-98dd-49be5a77d05f)

Did you start the trial license and then configure TLS and security for Elasticsearch and Kibana?

If not, you should use `http` and not `https` when connecting to Kibana.

---

<div class="post-metadata">

**Author:** ![ishashank](https://avatars.discourse-cdn.com/v4/letter/i/6f9a4e/32.png) [@ishashank](https://discuss.elastic.co/u/ishashank)\
**Post date:** [March 14, 2019, 9:28am UTC](https://discuss.elastic.co/t/error-403-forbidden-while-trying-to-create-indexpattern-for-filebeat-tried-most-of-the-solutions/172182/4 "2019-03-14T09:28:14Z")

</div>

Hi John,  
Thanks for the reply  
yes I do have both read and write access(including root access). Do you mean I need to mention that in the setup command ?  
Am I missing some additional permission setup? I haven't setup xpack module at all. I'd like to first make it work without it if possible.

---

<div class="post-metadata">

**Author:** ![ishashank](https://avatars.discourse-cdn.com/v4/letter/i/6f9a4e/32.png) [@ishashank](https://discuss.elastic.co/u/ishashank)\
**Post date:** [March 14, 2019, 9:32am UTC](https://discuss.elastic.co/t/error-403-forbidden-while-trying-to-create-indexpattern-for-filebeat-tried-most-of-the-solutions/172182/5 "2019-03-14T09:32:05Z")

</div>

Hi Lee,

Thanks for the response.

I haven't started/configured any kind of licence for the whole setup, I'm using the basic license of elasticsearch. And  
I'm using the apache proxy to redirect every request via myhostname (https) to the kibana (http). In my apache conf I've added the below proxy setting (for both 80 and 443):

```
    ProxyPass /kibana/ http://127.0.0.1:5601/
    ProxyPassReverse /kibana/ http://127.0.0.1:5601/

```

Hence I did't do the TLS setup for my Kibana installation.

---

<div class="post-metadata">

**Author:** ![ishashank](https://avatars.discourse-cdn.com/v4/letter/i/6f9a4e/32.png) [@ishashank](https://discuss.elastic.co/u/ishashank)\
**Post date:** [March 15, 2019, 11:49am UTC](https://discuss.elastic.co/t/error-403-forbidden-while-trying-to-create-indexpattern-for-filebeat-tried-most-of-the-solutions/172182/6 "2019-03-15T11:49:40Z")

</div>

Any updates from anyone on the above issue?

---

<div class="post-metadata">

**Author:** ![ishashank](https://avatars.discourse-cdn.com/v4/letter/i/6f9a4e/32.png) [@ishashank](https://discuss.elastic.co/u/ishashank)\
**Post date:** [March 22, 2019, 12:31pm UTC](https://discuss.elastic.co/t/error-403-forbidden-while-trying-to-create-indexpattern-for-filebeat-tried-most-of-the-solutions/172182/7 "2019-03-22T12:31:37Z")

</div>

Hi Everyone,

Could anyone please tell me if I need to post it to the elastic search support? And if yes, how to do it?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2019, 12:31pm UTC](https://discuss.elastic.co/t/error-403-forbidden-while-trying-to-create-indexpattern-for-filebeat-tried-most-of-the-solutions/172182/8 "2019-04-19T12:31:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.