Error importing URL/file: Failed to import index-pattern: : error loading /tmp/tmp401063577/beats-dashboards-5.4.0/filebeat/index-pattern/filebeat.json: couldn't load json. Error: 401 Unauthorized

Elastic Stack Beats
21

Hello Parth,

I am still getting the below error logs in filebeat logs -

tail -f /var/log/filebeat/filebeat
2017-08-19T00:34:00+05:30 INFO Start sending events to output
2017-08-19T00:34:00+05:30 INFO Harvester started for file: /var/log/filebeat/filebeat
2017-08-19T00:34:00+05:30 INFO Harvester started for file: /var/log/messages
2017-08-19T00:34:05+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized
2017-08-19T00:34:06+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized
2017-08-19T00:34:08+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized
2017-08-19T00:34:12+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized
2017-08-19T00:34:20+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized
2017-08-19T00:34:30+05:30 INFO Non-zero metrics in the last 30s: filebeat.harvester.open_files=2 filebeat.harvester.running=2 filebeat.harvester.started=2 libbeat.es.publish.read_bytes=1965 libbeat.es.publish.write_bytes=615 libbeat.publisher.published_events=277
2017-08-19T00:34:36+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized
2017-08-19T00:35:00+05:30 INFO Non-zero metrics in the last 30s: libbeat.es.publish.read_bytes=393 libbeat.es.publish.write_bytes=123
2017-08-19T00:35:08+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized
2017-08-19T00:35:30+05:30 INFO Non-zero metrics in the last 30s: libbeat.es.publish.read_bytes=393 libbeat.es.publish.write_bytes=123

What couldbe the problem. Due to that My kibana stopped showing logs

22

The http response 401 Unauthorized means you are missing username and password.

23

where i need to define the username and password in filebeat to avoid this error message.? Please guide me. I have been playing with this error since last week and still no solution.

24

Add username and password to the elasticsearch output (See the documentation and Elasticsearch output docs).

25

Thanks steffen,

It worked .. Appreciate your help. I am trying to configure email account in elk.yml file but it keep failing to send the email through wachter .. if i send email from servers root to my email .. it worked but not through the x-pack..not sure what i am doing wrong.below is my email config --

===========================

#"actions" : {

"send_email" : {

"email" : {

"to" : "aryaa.sandip@gmail.com",

"subject" : "Watcher Notification",

"body" : "{{ctx.payload.hits.total}} error logs found"

}

}

#}
xpack.notification.email.account:
smtp_account:
profile: standard
smtp:
auth: false
starttls.enable: false
host: appmgt-5.in.ibm.com
port: 25

===========================

Thanks,
Sandy

26

Uhm, for issues with watcher better ask in the X-Pack forums. Also include logs. Just from configs it's hard to tell what's going wrong.