I have this problem with metricbeat: error.message HTTP error 403 in : 403 Forbidden event.dataset elasticsearch.enrich This is my metricbeat.yml output.elasticsearch: # Array of hosts to connect to. hosts: ["my.ip:9200", "my.ip:9200"] # Optional protocol and basic auth credentials. #pr…

Problem solved. Monitoring user was lacking enrich_user role. I have created custom monitoring user and now everything works fine.

Error.message HTTP error 403 in : 403 Forbidden event.dataset elasticsearch.enrich

tennaen (Norbert Grzebieniarz) January 28, 2020, 6:06am 5

One more thing: i've updated all my ELK to 7.5.2.

Topic		Replies	Views
Metricbeat 5.5 at Win Server 2008 fails to send data to elasticsearch 5.5 Beats metricbeat	2	741	August 14, 2017
Metricbeat-7.16.2 HTTP error 401 in : 401 Unauthorized Beats metricbeat	2	2326	February 16, 2022
Metricbeat user and Elasticsearch connection Beats metricbeat	6	2306	April 7, 2017
Why Oh Why Oh Why will Metricbeat failing to connect to elasticsearch? Beats metricbeat	8	9781	July 24, 2017
HTTP error 401 in node: 401 Unauthorized Beats metricbeat	3	5656	June 15, 2018