Error starting Metricbeat

[adrisr (Adrian Serrano)]

I can think of two causes for this.

Are you using any Security features? (Do you have a security section under Management, in Kibana?) Access restrictions can be forbidding metricbeat to access the .kibana index.

Another cause can be a problem as described in this post:

FORBIDDEN/12/index read-only / allow delete (api)]

I'm currently having the same issue with some ES indices. I'd say it has nothing to do with Logstash. For me, the issue started occurring after the file system of the server running Elasticsearch had been over its threshold. I tried restarting the cluster (currently a single node), but to no avail. The only thing that helped was reindexing the data in order not to lose anything, then deleting the existing indices. I'm still trying to solve the same issue for the .kibana index though. Any adv…

For which the solution is to run this command in Kibana -> Dev Tools -> Console:

PUT .kibana/_settings
{
"index": {
"blocks": {
"read_only_allow_delete": "false"
}
}
}