# Filebeat index pattern is created in ES. but cant be mapped by kibana

**URL:** <https://discuss.elastic.co/t/filebeat-index-pattern-is-created-in-es-but-cant-be-mapped-by-kibana/112198>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 18, 2017, 9:54am UTC](https://discuss.elastic.co/t/filebeat-index-pattern-is-created-in-es-but-cant-be-mapped-by-kibana/112198 "2017-12-18T09:54:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ree](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@Ree](https://discuss.elastic.co/u/Ree)\
**Post date:** [December 18, 2017, 9:54am UTC](https://discuss.elastic.co/t/filebeat-index-pattern-is-created-in-es-but-cant-be-mapped-by-kibana/112198/1 "2017-12-18T09:54:42Z")

</div>

my file index pattern is created on elasticsearch.  
but wen i m trying to create a new index pattern in kibana.this is the output:  
Unable to fetch mapping. Do you have indices matching the pattern?  
i performed a search query on filebeat index using kibana console which gave this output.  
Query:  
GET /filebeat-6.0.0-2017.11.25/\_search  
{  
"query" : {  
"match\_all" : {}  
}

}  
output:  
{  
"error": {  
"root\_cause": [  
{  
"type": "security\_exception",  
"reason": "action [indices:data/read/search] is unauthorized for user [kibana]"  
}  
],  
"type": "security\_exception",  
"reason": "action [indices:data/read/search] is unauthorized for user [kibana]"  
},  
"status": 403  
}

plzz help me with this.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [December 18, 2017, 7:01pm UTC](https://discuss.elastic.co/t/filebeat-index-pattern-is-created-in-es-but-cant-be-mapped-by-kibana/112198/2 "2017-12-18T19:01:54Z")

</div>

Hi Ree,

Are you using Elasticsearch and X-Pack version 6.0.0?

What roles do you have set for the `kibana` user? See Management -\> Security -\> Users and Roles.

---

<div class="post-metadata">

**Author:** ![Ree](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@Ree](https://discuss.elastic.co/u/Ree)\
**Post date:** [December 18, 2017, 7:25pm UTC](https://discuss.elastic.co/t/filebeat-index-pattern-is-created-in-es-but-cant-be-mapped-by-kibana/112198/3 "2017-12-18T19:25:36Z")

</div>

hi adrisr  
Yes  
This is the message in User and roles:

You do not have permission to manage users.  
Please contact your administrator.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [December 19, 2017, 10:39am UTC](https://discuss.elastic.co/t/filebeat-index-pattern-is-created-in-es-but-cant-be-mapped-by-kibana/112198/4 "2017-12-19T10:39:33Z")

</div>

Finally I understand whats going on. You're logging into Kibana as the `kibana` user. This is an internal user that is not meant to be used. Please log out of Kibana and use the `elastic` user. The default password is `changeme` if you're using the docker environment.

---

<div class="post-metadata">

**Author:** ![Ree](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@Ree](https://discuss.elastic.co/u/Ree)\
**Post date:** [December 21, 2017, 10:04am UTC](https://discuss.elastic.co/t/filebeat-index-pattern-is-created-in-es-but-cant-be-mapped-by-kibana/112198/5 "2017-12-21T10:04:46Z")

</div>

Thank you it worked

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 18, 2018, 10:05am UTC](https://discuss.elastic.co/t/filebeat-index-pattern-is-created-in-es-but-cant-be-mapped-by-kibana/112198/6 "2018-01-18T10:05:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.