# Error.message HTTP error 403 in : 403 Forbidden event.dataset elasticsearch.enrich

**URL:** <https://discuss.elastic.co/t/error-message-http-error-403-in-403-forbidden-event-dataset-elasticsearch-enrich/216425>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [January 24, 2020, 1:32pm UTC](https://discuss.elastic.co/t/error-message-http-error-403-in-403-forbidden-event-dataset-elasticsearch-enrich/216425 "2020-01-24T13:32:43Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tennaen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tennaen/32/87293_2.png) [@tennaen](https://discuss.elastic.co/u/tennaen)\
**Post date:** [January 24, 2020, 1:32pm UTC](https://discuss.elastic.co/t/error-message-http-error-403-in-403-forbidden-event-dataset-elasticsearch-enrich/216425/1 "2020-01-24T13:32:44Z")

</div>

I have this problem with metricbeat:  
error.message HTTP error 403 in : 403 Forbidden  
event.dataset elasticsearch.enrich  
This is my metricbeat.yml

```
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["my.ip:9200", "my.ip:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  username: "remote_monitoring_user"
  password: "${remote.monitoring.user}"

setup.ilm.enabled: false

```

And elasticsearch-xpack.yml:

```
- module: elasticsearch
  metricsets:
    - ccr
    - cluster_stats
    - enrich
    - index
    - index_recovery
    - index_summary
    - ml_job
    - node_stats
    - shard
  period: 10s
  hosts: ["http://my.ip:9200"]
  username: "remote_monitoring_user"
  password: "${remote.monitoring.user}"
  xpack.enabled: true

```

Elasticsearch version is 7.5.1  
Metricbeat version is 7.5.2

Log entry:

```
2020-01-24T14:36:49.234+0100 INFO module/wrapper.go:252 Error fetching data for metricset elasticsearch.enrich: HTTP error 403 in : 403 Forbidden
```

---

<div class="post-metadata">

**Author:** ![tennaen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tennaen/32/87293_2.png) [@tennaen](https://discuss.elastic.co/u/tennaen)\
**Post date:** [January 24, 2020, 1:45pm UTC](https://discuss.elastic.co/t/error-message-http-error-403-in-403-forbidden-event-dataset-elasticsearch-enrich/216425/2 "2020-01-24T13:45:21Z")

</div>

I have 2 elasticsearch nodes and only 1 node has this entry. Configuration of both files is the same.

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [January 27, 2020, 10:47pm UTC](https://discuss.elastic.co/t/error-message-http-error-403-in-403-forbidden-event-dataset-elasticsearch-enrich/216425/3 "2020-01-27T22:47:11Z")

</div>

Hi @tennaen, sorry I'm trying to figure out the setup here. Do you have one Metricbeat running and trying to write data to two different Elasticsearch nodes? Have you tried to specify `protocol: "https"` under `output.elasticsearch` config?

---

<div class="post-metadata">

**Author:** ![tennaen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tennaen/32/87293_2.png) [@tennaen](https://discuss.elastic.co/u/tennaen)\
**Post date:** [January 28, 2020, 5:53am UTC](https://discuss.elastic.co/t/error-message-http-error-403-in-403-forbidden-event-dataset-elasticsearch-enrich/216425/4 "2020-01-28T05:53:56Z")

</div>

Hi @Kaiyan_Sheng, my elasticsearch isn't secured with https, so i'm not using this config. Well yes, i have 2 nodes of elasticsearch and 2 metricbeats running on each Elastic node. I can try to change config and write output only to one of elastic nodes.

---

<div class="post-metadata">

**Author:** ![tennaen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tennaen/32/87293_2.png) [@tennaen](https://discuss.elastic.co/u/tennaen)\
**Post date:** [January 28, 2020, 6:06am UTC](https://discuss.elastic.co/t/error-message-http-error-403-in-403-forbidden-event-dataset-elasticsearch-enrich/216425/5 "2020-01-28T06:06:36Z")

</div>

One more thing: i've updated all my ELK to 7.5.2.

---

<div class="post-metadata">

**Author:** ![tennaen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tennaen/32/87293_2.png) [@tennaen](https://discuss.elastic.co/u/tennaen)\
**Post date:** [February 5, 2020, 7:30am UTC](https://discuss.elastic.co/t/error-message-http-error-403-in-403-forbidden-event-dataset-elasticsearch-enrich/216425/6 "2020-02-05T07:30:55Z")

</div>

Problem solved. Monitoring user was lacking enrich\_user role. I have created custom monitoring user and now everything works fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 4, 2020, 7:31am UTC](https://discuss.elastic.co/t/error-message-http-error-403-in-403-forbidden-event-dataset-elasticsearch-enrich/216425/7 "2020-03-04T07:31:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.