# Error while creating index template in elastisearch

**URL:** <https://discuss.elastic.co/t/error-while-creating-index-template-in-elastisearch/201698>\
**Category:** Logstash\
**Created:** [September 30, 2019, 8:35pm UTC](https://discuss.elastic.co/t/error-while-creating-index-template-in-elastisearch/201698 "2019-09-30T20:35:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dje](https://avatars.discourse-cdn.com/v4/letter/d/a88e57/32.png) [@dje](https://discuss.elastic.co/u/dje)\
**Post date:** [September 30, 2019, 8:35pm UTC](https://discuss.elastic.co/t/error-while-creating-index-template-in-elastisearch/201698/1 "2019-09-30T20:35:35Z")

</div>

Hi everyone,

This is my setup :

- Elasticsearch 7.3.2 + Kibana 7.3.2 on Ubuntu (x-pack/ssl on both)
- logstash 7.3.2 on Ubuntu

I get the following error while trying to run logstash against ES :

> $ sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash  
> ...  
> [2019-09-30T13:12:22,469][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"index\_patterns"=\>"logstash-\*", "version"=\>60001, "settings"=\> \<...cropped...\>}}  
> warning: thread "Ruby-0-Thread-5: :1" terminated with exception (report\_on\_exception is true):  
> LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError: Got response code '403' contacting Elasticsearch at URL '[https://xxx:9200/logstash](https://xxx:9200/logstash)'  
> perform\_request at /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/manticore\_adapter.rb:80  
> perform\_request\_to\_url at /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:291  
> ...

I created the logstash\_writer role :

> curl -k -u elastic:xxx -X GET "[https://xxx:9200/\_security/role/logstash\_writer](https://xxx:9200/_security/role/logstash_writer)"  
> {  
> "logstash\_writer":  
> {  
> "cluster": ["manage\_index\_templates","monitor","manage\_ilm"],  
> "indices": [  
> {  
> "names":["logstash-\*"],  
> "privileges":["write","create","delete","create\_index","manage","manage\_ilm"],  
> "allow\_restricted\_indices":false  
> }],  
> "applications":,  
> "run\_as":,  
> "metadata":{},  
> "transient\_metadata":{"enabled":true}  
> }  
> }

I also created the logstash\_internal :

> curl -k -u elastic:xxx -X GET "[https://xxx:9200/\_security/user/logstash\_internal](https://xxx:9200/_security/user/logstash_internal)"  
> {  
> "logstash\_internal":  
> {  
> "username":"logstash\_internal",  
> "roles":["logstash\_writer"],  
> "full\_name":"Internal Logstash User",  
> "email":null,  
> "metadata":{},  
> "enabled":true  
> }  
> }

My /etc/logstash/logstash.yml is :

> path.data: /var/lib/logstash  
> path.logs: /var/log/logstash

My conf.d/pipeline-filebeat.conf file looks like :

> input {  
> beats {  
> port =\> "5044"  
> }  
> }  
> output {  
> elasticsearch {  
> hosts =\> ["xxx:9200"]  
> ssl =\> true  
> cacert =\> '/etc/logstash/certs/elastic\_ca.crt'  
> user =\> logstash\_internal  
> password =\> 'xxx'  
> index =\> "logstash-%{+YYYY.MM.dd}"  
> }  
> }

When I try curl -k -u logstash\_internal:xxx -XPUT "[https://xxx:9200/logstash-idxtest2](https://xxx:9200/logstash-idxtest2)", I receive :

> {  
> "acknowledged":true,  
> "shards\_acknowledged":true,  
> "index":"logstash-idxtest2"  
> }

I guess 'logstash\_internal' has proper rights on logstash-\* indexes, yet, I get the error shown above when I try to start logstash.

I think i'm close to the solution, but I can't find what I'm missing... Sorry if this question has already been answered, I could not find a proper solution.

Thanks in advance,  
Dj

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 28, 2019, 8:35pm UTC](https://discuss.elastic.co/t/error-while-creating-index-template-in-elastisearch/201698/2 "2019-10-28T20:35:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.