# Error in Winlogbeat logs

**URL:** <https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [July 18, 2018, 8:43am UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485 "2018-07-18T08:43:03Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 18, 2018, 8:43am UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/1 "2018-07-18T08:43:03Z")

</div>

Winlogbeat has been working fine for a week now, today I turned my computer on and it just wouldnt load todays logs.  
I checked the logs and this is what it says:

```
2018-07-18T09:32:27.192+0100	ERROR	instance/beat.go:691	Exiting: Error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory C:\software\winlogbeat\kibana: Failed to import index-pattern: Failed to load directory C:\software\winlogbeat\kibana/6/index-pattern:
  error loading C:\software\winlogbeat\kibana\6\index-pattern\winlogbeat.json: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];. Response: {"objects":[{"id":"winlogbeat-*","type":"index-pattern","error":{"message":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}}]}

```

any idea?

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [July 18, 2018, 9:41am UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/2 "2018-07-18T09:41:53Z")

</div>

Your Elasticsearch index has turned read-only, that's why Winlogbeat can't ship the logs.

It might be that Elasticsearch is running out of disk, or other reasons.

Have a look at [FORBIDDEN/12/index read-only / allow delete (api)]](https://discuss.elastic.co/t/forbidden-12-index-read-only-allow-delete-api/110282)

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 18, 2018, 9:56am UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/3 "2018-07-18T09:56:09Z")

</div>

Yes, i just ran across that thread, I have cleared my logs and will test then. Will update the threat if anything.

Thanks

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 18, 2018, 10:00am UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/4 "2018-07-18T10:00:20Z")

</div>

It is working now, I had to delete old logs

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 18, 2018, 12:07pm UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/5 "2018-07-18T12:07:36Z")

</div>

Hey, I came back after an hour and this came up on monitoring:

> We couldn't activate monitoring  
> Here might be some things to check
> 
> No Monitoring data could be found for the selected time period, but we could not find the cluster setting that makes the data unavailable.
> 
> There may be data available for a different time period than we have selected. Try adjusting the time filter controls to a time range where the Monitoring data is expected.
> 
> We are refreshing the search for data in the background. If cluster data is found, we will redirect to the cluster overview page.

and this:

```
Monitoring Request Failed

Unable to find the cluster in the selected time range. UUID: BZrLFZApRyWIsTznQpzRfg

HTTP 404

```

I can see data if the time period is longer than 4 hours, however there are no recent logs being shipped. When I restarted winlogbeat I got this error:

```
Start-Service : Failed to start service 'winlogbeat (winlogbeat)'.
At line:1 char:1
+ Start-Service winlogbeat
+ ~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController)
   ServiceCommandException
    + FullyQualifiedErrorId : StartServiceFailed,Microsoft.PowerShell.Commands.StartServiceCommand

```

After running this command on PS:  
.\winlogbeat.exe -c winlogbeat.yml -e -v -d "\*"

```
2018-07-18T14:09:04.894+0100	ERROR	instance/beat.go:691	Exiting: Error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory C:\software\winlogbeat\kibana: Failed to import index-pattern: Failed to load directory C:\software\winlogbeat\kibana/6/index-pattern:
  error loading C:\software\winlogbeat\kibana\6\index-pattern\winlogbeat.json: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];. Response: {"objects":[{"id":"winlogbeat-*","type":"index-pattern","error":{"message":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}}]}

```

to solve this issue ^: I ran this

```
 PUT _settings
    {
    "index": {
    "blocks": {
    "read_only_allow_delete": "false"
    }
    }
    }

```

Any clues as to why I am getting this?

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 18, 2018, 2:54pm UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/6 "2018-07-18T14:54:09Z")

</div>

edit1: I restart winlogbeat and now it cannot start on windows. This seems to be a routine. Everytime after I run something if I restart it automatically gives this error:

> 2018-07-18T15:39:38.075+0100 ERROR instance/beat.go:691 Exiting: Error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory C:\software\winlogbeat\kibana: Failed to import index-pattern: Failed to load directory C:\software\winlogbeat\kibana/6/index-pattern:  
> error loading C:\software\winlogbeat\kibana\6\index-pattern\winlogbeat.json: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];. Response: {"objects":[{"id":"winlogbeat-\*","type":"index-pattern","error":{"message":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}}]}

I don't know how to fix this error without having to delete the logs. It's not running out of memory:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c7220fe06ef97e0fd13906babff5a02813ae0d5f.png)

and I already ran this on dev tools:

> PUT winlogbeat-\*/\_settings  
> {  
> "index": {  
> "blocks": {  
> "read\_only\_allow\_delete": "false"  
> }  
> }  
> }

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [July 18, 2018, 3:17pm UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/7 "2018-07-18T15:17:50Z")

</div>

`filebeat setup` wants to setup different things, some of them being the index templates and pipelines, which need to be done in Elasticsearch. If you want to setup only the dashboards, try adding `--dashboards`. Then elasticsearch output won't be required.

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 18, 2018, 3:38pm UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/10 "2018-07-18T15:38:37Z")

</div>

Im sorry, seems like I got the posts mixed up. I am having this issue with winlogbeat not filebeat. Well, I was having with both. So, I just deleted filebeat for now and trying to work with winlogbeat.

If I do as you said, I get this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/d/1dac63261b4dfba963ed4beb88b53ecf85288a3a.png)  
or if I run a different command:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/9/9994cb383f6a43a2cc6f814c6fe766491beaffed.png)

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [July 18, 2018, 10:09pm UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/11 "2018-07-18T22:09:54Z")

</div>

Marcos, it looks like the root cause here is that your ES instance has been put back into a read-only state. Have you checked the ES logs?

Are you running low on disk space? That can cause this situation. You may have to re-enable writes to that index if it has been closed due to low disk space.

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 19, 2018, 8:09am UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/12 "2018-07-19T08:09:58Z")

</div>

I have checked the elastic logs and it is indeed full, but I dont understand those logs. Are they the winlogbeats logs ive been submitting? Also, how can I delete these logs? would it be safe to ?  
You mentioned re-enabling writes to that index if its has been closed cause of low disk space, how do I go on about doing this?

Thanks

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 19, 2018, 2:00pm UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/14 "2018-07-19T14:00:32Z")

</div>

> [@Andrew\_Cholakian1](#):
>
> Are you running low on disk space? That can cause this situation. You may have to re-enable writes to that index if it has been closed due to low disk space.

I got it to work now, increase disk space. Winlogbeat is running but for some reason it isn't forwarding any logs to Kibana, there is nothing on the winlogbeat logs and it starts and stops just fine. Any clues?

edit1: fixed, I had to delete the logs so it would start logging again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2018, 2:00pm UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485/15 "2018-08-16T14:00:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.