Failed to import dashboard 7.2.0

Elastic Stack Kibana
1

ES version: 7.2.0 (with xpack.security.enabled: true)
Kibana version: 7.2.0
Filebeat version: 7.2.0

Hello guys!
I tried add data to Kibana with filebeat. And when i run command "filebeat setup" i see some errors in output logs. Whats wrong?

Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Exiting: Failed to import dashboard: Failed to load directory /usr/share/filebeat/kibana/7/dashboard:
error loading /usr/share/filebeat/kibana/7/dashboard/Coredns-Overview-Dashboard.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-Cisco-ASA.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-Envoyproxy-Overview.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-Iptables-Overview.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-Iptables-Ubiquiti-Firewall-Overview.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-Kafka-overview.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-Mongodb-overview.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-Postgresql-overview.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-Postgresql-slowlogs.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-Suricata-Alert-Overview.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-Suricata-Overview.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-Zeek-Overview.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-apache.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-auditd.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-auth-sudo-commands.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-haproxy-overview.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-icinga-debug-log.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-icinga-main-log.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-icinga-startup-errors.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-iis.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-logstash-log.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-logstash-slowlog.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-mysql.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,search,visualization"}
error loading /usr/share/filebeat/kibana/7/dashboard/Filebeat-nats-overview.json: returned 400 to import file: . Response: {"statusCode":400,"error":"Bad Request","message":"Unable to bulk_create dashboard,visualization"}
} and etc......

2

Hello,

We are experiencing the same issue.

Grtz

Willem

3

hi

the same error with auditbeat & metricbeat too :frowning:

4

@sqren Can you help us?

5

We are having the same issue here. Have removed some templates. Tried enabling the compatibility mode <migration.6_to_7.enabled: true> . Anyone have a fix?

6

I saw a case recently where this error was hiding a permission issue. Do people on this thread have Kibana security enabled? If yes, please double check that the Beats user has the required privileges (esp. kibana_user).

1 Like
7

Fyi, I've been able to reproduce it and have opened a bug report at https://github.com/elastic/kibana/issues/40714

8

Where is the permission lists for kibana user and beat user to check?

9

@golaso kibana_user is the only role your Kibana user should need to import dashboards.

The filebeat setup command also sets up things in Elasticsearch and so needs beats_system and ingest_admin as well I think. Not all of these privileges are necessary after running setup.

11

Well, now i have this error with beats_system and ingest_admin permissions for beat user:
action [indices:admin/create] is unauthorized for user [metricbeat_internal]
What index (or index pattern) requires this permission?
I already have create , create_index , write , manage_ilm permissions on metricbeat-* index pattern.

12

@golaso Sorry, my bad. I've done some testing, here's what privileges should be required. You can create roles that have these and then assign them to the user(s).

Setup

  1. monitor
  2. manage_ilm
  3. manage_index_templates
  4. manage (on metricbeat-*)
  5. manage_pipeline
  6. + kibana_user (separate role to load Kibana dashboards)

Run

  1. monitor
  2. read_ilm
  3. manage_index_templates
  4. view_index_metadata (on metricbeat-*)
  5. index (on metricbeat-*)
1 Like
13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.