# Filebeat -\> elastic: onConnect callback failed: error loading template
**URL:** https://discuss.elastic.co/t/filebeat-elastic-onconnect-callback-failed-error-loading-template/296121
**Category:** Beats
**Tags:** filebeat
**Created:** [February 2, 2022, 8:14pm UTC](https://discuss.elastic.co/t/filebeat-elastic-onconnect-callback-failed-error-loading-template/296121 "2022-02-02T20:14:09Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [February 2, 2022, 8:14pm UTC](https://discuss.elastic.co/t/filebeat-elastic-onconnect-callback-failed-error-loading-template/296121/1 "2022-02-02T20:14:10Z")
I have followed the instructions here: [Grant privileges and roles needed for publishing | Filebeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/privileges-to-publish-events.html#privileges-to-publish-events)
I have `setup.ilm.check_exists: false` set in `/etc/filebeat/filebeat.yml`
See screenshot of my role below. I have a user `filebeat_writer` with only the same role `filebeat_writer` But I am getting this error.
```auto
Feb 2 12:06:50 proxy02 filebeat[1311272]: 2022-02-02T12:06:50.478-0800#011ERROR#011[publisher_pipeline_output]#011pipeline/output.go:154#011Failed to connect to backoff(elasticsearch(http://elasticsearch.asdf.co:9200)): Connection marked as failed because the onConnect callback failed: error loading template: failure while checking if template exists: 403 Forbidden:
```
I want to use least privilege but also must receieve the data! What privileges must I set so that this can function? Is the documentation not correct?
* * *
edit: I [followed these instructions](https://kifarunix.com/configure-filebeat-elasticsearch-authentication/) which recommend `cluster: monitor, manage` and `Index: monitor, create_index, create_doc, view_index_metadata, manage_ilm` and I get data. However I am unsure about using these settings because 1) elastic recommendation is different (as shown in instructions above) and 2) I want to be certain of using least privilege model.
* * *
---
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [February 3, 2022, 2:47am UTC](https://discuss.elastic.co/t/filebeat-elastic-onconnect-callback-failed-error-loading-template/296121/2 "2022-02-03T02:47:24Z")
Can anyone comment (esp Elastic Team) as to whether the privileges noted in Elastic documentation is known to work. And if there is certainty the documentation is correct, then why would this be failing?
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [February 7, 2022, 2:10pm UTC](https://discuss.elastic.co/t/filebeat-elastic-onconnect-callback-failed-error-loading-template/296121/3 "2022-02-07T14:10:52Z")
In 7.16/7.17 Filebeat uses `GET _index_template` API to check if the template exists. Your user needs the `manage_index_templates` or `manage` cluster privilege.
Ref: [Get index template API | Elasticsearch Guide [7.17] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-template.html#get-template-api-prereqs)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 7, 2022, 4:11pm UTC](https://discuss.elastic.co/t/filebeat-elastic-onconnect-callback-failed-error-loading-template/296121/4 "2022-03-07T16:11:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.