# Error starting Metricbeat

**URL:** <https://discuss.elastic.co/t/error-starting-metricbeat/142088>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [July 30, 2018, 4:29am UTC](https://discuss.elastic.co/t/error-starting-metricbeat/142088 "2018-07-30T04:29:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![markt277](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markt277/32/33829_2.png) [@markt277](https://discuss.elastic.co/u/markt277)\
**Post date:** [July 30, 2018, 4:29am UTC](https://discuss.elastic.co/t/error-starting-metricbeat/142088/1 "2018-07-30T04:29:02Z")

</div>

Hi there

I'm having trouble getting Metricbeat running on a Linux VM. Filebeat was installed six months ago by a colleague and works perfectly fine. We are only using the Elasticsearch and Filebeat parts of the stack. We would like to use Metricbeat as well.

I did need to sudo chmod 644 the /etc/metricbeat/metricbeat.yml file.

My current problem is when I try to run "sudo service metricbeat start", the command does not succeed.

Looking in /var/log/metricbeat/metricbeat reveals the error to be: "Exiting: Error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory /usr/share/metricbeat/kibana: Failed to import index-pattern: Failed to load directory /usr/share/metricbeat/kibana/6/index-pattern:  
error loading /usr/share/metricbeat/kibana/6/index-pattern/metricbeat.json: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];. Response: {"objects":[{"id":"metricbeat-\*","type":"index-pattern","error":{"message":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}}]}"

Is this error actually indicative of the disk being full? "df -h /var" informs me that the /var/ is only 60% full.

Can anyone please shed some light on what is going wrong?

Cheers

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [July 30, 2018, 3:39pm UTC](https://discuss.elastic.co/t/error-starting-metricbeat/142088/2 "2018-07-30T15:39:07Z")

</div>

I can think of two causes for this.

Are you using any Security features? (Do you have a security section under Management, in Kibana?) Access restrictions can be forbidding metricbeat to access the .kibana index.

Another cause can be a problem as described in this post:

> [@FORBIDDEN/12/index read-only / allow delete (api)\]](https://discuss.elastic.co/t/forbidden-12-index-read-only-allow-delete-api/110282/2):
>
> I'm currently having the same issue with some ES indices. I'd say it has nothing to do with Logstash. For me, the issue started occurring after the file system of the server running Elasticsearch had been over its threshold. I tried restarting the cluster (currently a single node), but to no avail. The only thing that helped was reindexing the data in order not to lose anything, then deleting the existing indices. I'm still trying to solve the same issue for the .kibana index though. Any adv…

For which the solution is to run this command in Kibana -\> Dev Tools -\> Console:

> PUT .kibana/\_settings  
> {  
> "index": {  
> "blocks": {  
> "read\_only\_allow\_delete": "false"  
> }  
> }  
> }

---

<div class="post-metadata">

**Author:** ![markt277](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markt277/32/33829_2.png) [@markt277](https://discuss.elastic.co/u/markt277)\
**Post date:** [July 30, 2018, 8:38pm UTC](https://discuss.elastic.co/t/error-starting-metricbeat/142088/3 "2018-07-30T20:38:16Z")

</div>

There's no Security section under Management in Kibana. Using Kibana version 6.0.1.

I'll try the PUT and report back.

Cheers

---

<div class="post-metadata">

**Author:** ![markt277](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markt277/32/33829_2.png) [@markt277](https://discuss.elastic.co/u/markt277)\
**Post date:** [July 30, 2018, 8:43pm UTC](https://discuss.elastic.co/t/error-starting-metricbeat/142088/4 "2018-07-30T20:43:00Z")

</div>

The PUT was the solution.

Thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2018, 8:43pm UTC](https://discuss.elastic.co/t/error-starting-metricbeat/142088/5 "2018-08-27T20:43:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.