# Filebeat upload log to es5 , 403

**URL:** https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266
**Category:** Elasticsearch
**Created:** [September 11, 2020, 6:02am UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266 "2020-09-11T06:02:44Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![Adonis\_Zzq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adonis_zzq/32/75410_2.png) [@Adonis\_Zzq](https://discuss.elastic.co/u/Adonis_Zzq)
#### Post date: [September 11, 2020, 6:02am UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266/1 "2020-09-11T06:02:44Z")

</div>

I use es 5.6.4 , filebeat upload log to es, return 403 ,What could cause this?  
The log is as follows:

```auto
2020-09-11T14:14:25+08:00 ERR Failed to perform any bulk index operations: 403 Forbidden

2020-09-11T14:14:25+08:00 INFO Error publishing events (retrying): 403 Forbidden

2020-09-11T14:14:25+08:00 ERR Failed to perform any bulk index operations: 403 Forbidden

2020-09-11T14:14:25+08:00 INFO Error publishing events (retrying): 403 Forbidden

2020-09-11T14:14:26+08:00 INFO Connected to Elasticsearch version 5.6.4

2020-09-11T14:14:26+08:00 INFO Connected to Elasticsearch version 5.6.4

2020-09-11T14:14:26+08:00 ERR Failed to perform any bulk index operations: 403 Forbidden

2020-09-11T14:14:26+08:00 INFO Error publishing events (retrying): 403 Forbidden

2020-09-11T14:14:26+08:00 ERR Failed to perform any bulk index operations: 403 Forbidden

2020-09-11T14:14:26+08:00 INFO Error publishing events (retrying): 403 Forbidden

2020-09-11T14:14:27+08:00 INFO Non-zero metrics in the last 30s: libbeat.es.publish.read_bytes=33756 libbeat.es.call_count.PublishEvents=58 libbeat.es.publish.write_bytes=19695408

2020-09-11T14:14:27+08:00 INFO Connected to Elasticsearch version 5.6.4

2020-09-11T14:14:27+08:00 INFO Connected to Elasticsearch version 5.6.4

2020-09-11T14:14:27+08:00 ERR Failed to perform any bulk index operations: 403 Forbidden

2020-09-11T14:14:27+08:00 INFO Error publishing events (retrying): 403 Forbidden

2020-09-11T14:14:27+08:00 ERR Failed to perform any bulk index operations: 403 Forbidden

2020-09-11T14:14:27+08:00 INFO Error publishing events (retrying): 403 Forbidden

2020-09-11T14:14:28+08:00 INFO Connected to Elasticsearch version 5.6.4

2020-09-11T14:14:28+08:00 INFO Connected to Elasticsearch version 5.6.4

2020-09-11T14:14:28+08:00 ERR Failed to perform any bulk index operations: 403 Forbidden

2020-09-11T14:14:28+08:00 INFO Error publishing events (retrying): 403 Forbidden

2020-09-11T14:14:28+08:00 ERR Failed to perform any bulk index operations: 403 Forbidden

2020-09-11T14:14:28+08:00 INFO Error publishing events (retrying): 403 Forbidden

2020-09-11T14:14:29+08:00 INFO Connected to Elasticsearch version 5.6.4

2020

```

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 11, 2020, 6:18am UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266/2 "2020-09-11T06:18:04Z")

</div>

Please check your Elasticsearch logs. Is it possible that the cluster [has run out of space and gone into read-only mode](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/disk-allocator.html)?

---

<div class="post-metadata">

### Author: ![Adonis\_Zzq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adonis_zzq/32/75410_2.png) [@Adonis\_Zzq](https://discuss.elastic.co/u/Adonis_Zzq)
#### Post date: [September 11, 2020, 6:23am UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266/3 "2020-09-11T06:23:11Z")

</div>

There is plenty of space, are there other possibilities?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 11, 2020, 6:24am UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266/4 "2020-09-11T06:24:16Z")

</div>

Is there anything else in the Elasticsearch logs?

---

<div class="post-metadata">

### Author: ![Adonis\_Zzq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adonis_zzq/32/75410_2.png) [@Adonis\_Zzq](https://discuss.elastic.co/u/Adonis_Zzq)
#### Post date: [September 11, 2020, 6:25am UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266/5 "2020-09-11T06:25:34Z")

</div>

```auto
[2020-09-11T14:41:39,450][INFO][o.e.p.o.OPackActionFilter] [node1] forbidden request: { ID:51f50c69e1fc4bf4b932eb4cdb67e4b5, TYP:BulkRequest, USR:tsf-es-1, BRS:true, ACT:indices:data/write/bulk, OA:22.188.116.201, IDX:filebeat-2020.09.11, MET:POST, PTH:/_bulk, CNT:<OMITTED, LENGTH=334391>, HDR:Authorization,Accept,User-Agent,Host,Accept-Encoding,Content-Length,Content-Type, EFF:0 } Reason: null
[2020-09-11T14:41:39,457][INFO][o.e.p.o.OPackActionFilter] [node1] forbidden request: { ID:c527c41c71da488fb4515c9b18de852b, TYP:BulkRequest, USR:tsf-es-1, BRS:true, ACT:indices:data/write/bulk, OA:22.188.116.216, IDX:filebeat-2020.09.11, MET:POST, PTH:/_bulk, CNT:<OMITTED, LENGTH=47541>, HDR:Authorization,Accept,User-Agent,Host,Accept-Encoding,Content-Length,Content-Type, EFF:0 } Reason: null
[2020-09-11T14:41:39,564][INFO][o.e.p.o.OPackActionFilter] [node1] forbidden request: { ID:221f1e0a05284003adf0d2966279b9e2, TYP:BulkRequest, USR:tsf-es-1, BRS:true, ACT:indices:data/write/bulk, OA:22.188.116.203, IDX:filebeat-2020.09.11, MET:POST, PTH:/_bulk, CNT:<OMITTED, LENGTH=22007>, HDR:Authorization,Accept,User-Agent,Host,Accept-Encoding,Content-Length,Content-Type, EFF:0 } Reason: null
[2020-09-11T14:41:39,566][INFO][o.e.p.o.OPackActionFilter] [node1] forbidden request: { ID:e859d0ab25564c079674d20712481bcd, TYP:BulkRequest, USR:tsf-es-1, BRS:true, ACT:indices:data/write/bulk, OA:22.188.116.217, IDX:filebeat-2020.09.11, MET:POST, PTH:/_bulk, CNT:<OMITTED, LENGTH=20775>, HDR:Authorization,Accept,User-Agent,Host,Accept-Encoding,Content-Length,Content-Type, EFF:0 } Reason: null
[2020-09-11T14:41:39,569][INFO][o.e.p.o.OPackActionFilter] [node1] forbidden request: { ID:61ee1415444842f8a8bf33745af1ffc6, TYP:BulkRequest, USR:tsf-es-1, BRS:true, ACT:indices:data/write/bulk, OA:22.188.116.203, IDX:filebeat-2020.09.11, MET:POST, PTH:/_bulk, CNT:<OMITTED, LENGTH=22007>, HDR:Authorization,Accept,User-Agent,Host,Accept-Encoding,Content-Length,Content-Type, EFF:0 } Reason: null
[2020-09-11T14:41:39,569][INFO][o.e.p.o.OPackActionFilte

```

---

<div class="post-metadata">

### Author: ![Adonis\_Zzq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adonis_zzq/32/75410_2.png) [@Adonis\_Zzq](https://discuss.elastic.co/u/Adonis_Zzq)
#### Post date: [September 11, 2020, 6:27am UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266/6 "2020-09-11T06:27:07Z")

</div>

```auto
[2020-09-11T14:43:23,562][DEBUG][o.e.a.b.TransportBulkAction] [node1] failed to execute pipeline [tsf-business-1-l6ymbvgd] for document [filebeat-2020.09.11/log/null]
java.lang.IllegalArgumentException: pipeline with id [tsf-business-1-l6ymbvgd] does not exist
        at org.elasticsearch.ingest.PipelineExecutionService.getPipeline(PipelineExecutionService.java:194) ~[elasticsearch-5.6.4.jar:5.6.4]
        at org.elasticsearch.ingest.PipelineExecutionService.access$100(PipelineExecutionService.java:41) ~[elasticsearch-5.6.4.jar:5.6.4]
        at org.elasticsearch.ingest.PipelineExecutionService$2.doRun(PipelineExecutionService.java:88) [elasticsearch-5.6.4.jar:5.6.4]
        at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:638) [elasticsearch-5.6.4.jar:5.6.4]
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-5.6.4.jar:5.6.4]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_232]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_232]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_232]
[2020-09-11T14:43:23,563][DEBUG][o.e.a.b.TransportBulkAction] [node1] failed to execute pipeline [tsf-business-1-l6ymbvgd] for document [filebeat-2020.09.11/log/null]
java.lang.IllegalArgumentException: pipeline with id [tsf-business-1-l6ymbvgd] does not exist
        at org.elasticsearch.ingest.PipelineExecutionService.getPipeline(PipelineExecutionService.java:194) ~[elasticsearch-5.6.4.jar:5.6.4]
        at org.elasticsearch.ingest.PipelineExecutionService.access$100(PipelineExecutionService.java:41) ~[elasticsearch-5.6.4.jar:5.6.4]
        at org.elasticsearch.ingest.PipelineExecutionService$2.doRun(PipelineExecutionService.java:88) [elasticsearch-5.6.4.jar:5.6.4]
        at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:638)

```

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 11, 2020, 6:32am UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266/7 "2020-09-11T06:32:29Z")

</div>

Which version of Filebeat are you using to ingest data into the cluster?

It seems the bulk requests specify an invalid ingest pipeline.

---

<div class="post-metadata">

### Author: ![Adonis\_Zzq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adonis_zzq/32/75410_2.png) [@Adonis\_Zzq](https://discuss.elastic.co/u/Adonis_Zzq)
#### Post date: [September 11, 2020, 7:02am UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266/8 "2020-09-11T07:02:13Z")

</div>

filebeat 5.0.0

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 11, 2020, 7:58am UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266/9 "2020-09-11T07:58:02Z")

</div>

Has the ingest pipeline mentioned in the logs been deployed?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 13, 2020, 11:24pm UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266/10 "2020-09-13T23:24:29Z")

</div>

Welcome to our community! 😃

Pleaser look at upgrading your stack ASAP. 5.X has been [EOL](https://www.elastic.co/support/eol) for quite some time and is no longer supported.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 11, 2020, 11:24pm UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266/11 "2020-10-11T23:24:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.