# Filbeat not Starting after enabling Security

**URL:** https://discuss.elastic.co/t/filbeat-not-starting-after-enabling-security/149611
**Category:** Beats
**Tags:** filebeat
**Created:** [September 24, 2018, 2:37am UTC](https://discuss.elastic.co/t/filbeat-not-starting-after-enabling-security/149611 "2018-09-24T02:37:08Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![hegdedarsh](https://avatars.discourse-cdn.com/v4/letter/h/4bbf92/32.png) [@hegdedarsh](https://discuss.elastic.co/u/hegdedarsh)
#### Post date: [September 24, 2018, 2:37am UTC](https://discuss.elastic.co/t/filbeat-not-starting-after-enabling-security/149611/1 "2018-09-24T02:37:08Z")

</div>

Hi,

All the beats were working fine till i had not enabled security(username/password). But when i enabled it, everything went down, and when i try to start the filebeat, it throws an the below error

Error:- 2018-09-24T10:28:12.858+0800 ERROR instance/beat.go:743 Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: Error creating Kibana client: fail to get the Kibana version: HTTP GET request to /api/status fails: . Response: {"statusCode":401,"error":"Unauthorized"}.  
Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: Error creating Kibana client: fail to get the Kibana version: HTTP GET request to /api/status fails: . Response: {"statusCode":401,"error":"Unauthorized"}.  
Exiting: error loading config file: yaml: line 169: did not find expected key

Since i am using logstash, I have enabled it like this in filebeat.yml, let me know whether i need to use logstash credentials to push the details from filebeat\>\> logstash

output.logstash:

# The Logstash hosts

hosts: ["XXXXXXXXX:5044"]

# Optional SSL. By default is off.

# List of root certificates for HTTPS server verifications

#ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"]

# Certificate for SSL client authentication

#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key

#ssl.key: "/etc/pki/client/cert.key"

```
 username: "elastic"
 password: "XXXXX"
```

---

<div class="post-metadata">

### Author: ![hegdedarsh](https://avatars.discourse-cdn.com/v4/letter/h/4bbf92/32.png) [@hegdedarsh](https://discuss.elastic.co/u/hegdedarsh)
#### Post date: [September 25, 2018, 1:46am UTC](https://discuss.elastic.co/t/filbeat-not-starting-after-enabling-security/149611/2 "2018-09-25T01:46:36Z")

</div>

I Followed the documentation for the latest 6.4 version and based on that i created a filebeat user internal and try to run it and I get the following error.

Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: Error creating Kibana client: can not convert 'object' into 'string' accessing 'setup.kibana.host' (source:'filebeat.yml')

---

<div class="post-metadata">

### Author: ![vishnuduttpv](https://avatars.discourse-cdn.com/v4/letter/v/5daacb/32.png) [@vishnuduttpv](https://discuss.elastic.co/u/vishnuduttpv)
#### Post date: [September 25, 2018, 5:11am UTC](https://discuss.elastic.co/t/filbeat-not-starting-after-enabling-security/149611/3 "2018-09-25T05:11:32Z")

</div>

After enabling the security, whether you created the users for ES, Kibana and logstash?  
Seems to be the issue with the credentials mismatch! Recommend to review the credentials of the respective users!  
Mentioned that you are pushing logs to the Logstash!

---

<div class="post-metadata">

### Author: ![hegdedarsh](https://avatars.discourse-cdn.com/v4/letter/h/4bbf92/32.png) [@hegdedarsh](https://discuss.elastic.co/u/hegdedarsh)
#### Post date: [September 25, 2018, 5:45am UTC](https://discuss.elastic.co/t/filbeat-not-starting-after-enabling-security/149611/4 "2018-09-25T05:45:28Z")

</div>

Yes, i am pushing logs to logstash, and the credentials seems to work fine now ,but now the filebeat harvestor is not working.

---

<div class="post-metadata">

### Author: ![vishnuduttpv](https://avatars.discourse-cdn.com/v4/letter/v/5daacb/32.png) [@vishnuduttpv](https://discuss.elastic.co/u/vishnuduttpv)
#### Post date: [September 25, 2018, 5:47am UTC](https://discuss.elastic.co/t/filbeat-not-starting-after-enabling-security/149611/5 "2018-09-25T05:47:34Z")

</div>

Could you paste the errors that are prompting in the beats log?

---

<div class="post-metadata">

### Author: ![hegdedarsh](https://avatars.discourse-cdn.com/v4/letter/h/4bbf92/32.png) [@hegdedarsh](https://discuss.elastic.co/u/hegdedarsh)
#### Post date: [September 25, 2018, 6:00am UTC](https://discuss.elastic.co/t/filbeat-not-starting-after-enabling-security/149611/6 "2018-09-25T06:00:09Z")

</div>

es:admin/create] is unauthorized for user [kibana]"})  
[2018-09-25T13:52:28,360][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"security\_exception", "reason"=\>"action [indices:admin/create] is unauthorized for user [kibana]"})  
[2018-09-25T13:52:28,360][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"security\_exception", "reason"=\>"action [indices:admin/create] is unauthorized for user [kibana]"})  
[2018-09-25T13:52:28,360][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"security\_exception", "reason"=\>"action [indices:admin/create] is unauthorized for user [kibana]"})

But now the issue is fixed, as the user kibana didnt have the permissions. So yes you are right , user and roles played an important role now. The issue is fixed.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 23, 2018, 6:00am UTC](https://discuss.elastic.co/t/filbeat-not-starting-after-enabling-security/149611/7 "2018-10-23T06:00:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
