How fix “Failed to import index-pattern”

Elastic Stack Beats
1

When i`m try setup metricbeat dashboard i get error.

i run this command:
// metricbeat setup --dashboards
and got this error:
metricbeat setup --dashboards Loading dashboards (Kibana must be running and reachable) Exiting: Failed to import index-pattern: Failed to load directory /usr/share/metricbeat/kibana/6/index-pattern: error loading /usr/share/metricbeat/kibana/6/index- pattern/metricbeat.json: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];. Response: {"objects":[{"id":"metricbeat-*","type":"index- pattern","error":{"message":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}}]}
i try this :

```
https://benjaminknofe.com/blog/2017/12/23/forbidden-12-index-read-only-allow-delete-api-read-only-elasticsearch-indices/

https://discuss.elastic.co/t/forbidden-12-index-read-only-allow-delete-api/110282
```

it doesnt help me. in my hard drive im got more then 40% free space i restart elastic, kibana, metricbeat nothing help. all elastick stack installed on one server and metricbeat. also i`m try remove index metricbeat* - not help pls help !

2

can you share your filebeat config especially the way how your Kibana endpoint is configured
and also Kibana config would be useful to see if kibana is secured...

3

hi ! thanks for answer.
I have problem with metricbeat not filebeat.
my metricbeat config:

metricbeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
setup.kibana:

  
  host: "92.145.4.42:5601"


output.elasticsearch:
  hosts: ["92.145.4.42:9200"]
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

my Kibana config:
# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601

server.host: "0.0.0.0"


elasticsearch.hosts: ["http://92.145.4.42:9200"]

that is all .

4

What is your elastic search config like? It reminds me of the kind of error you get if you have security enabled but don't have a user setup for metric beat to manage indexes and write with.

5

This is my elasticsearch config:

cat /etc/elasticsearch/elasticsearch.yml | grep -v '#'

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.port: 9200
6 
GET metricbeat-*/_settings

If you run that from dev tools in kibana does it output anything?

7

when i`m run this:

GET metricbeat-*/_settings

i get:

{
  "metricbeat-6.7.1-2019.09.11" : {
    "settings" : {
      "index" : {
        "codec" : "best_compression",
        "mapping" : {
          "total_fields" : {
            "limit" : "10000"
          }
        }, ......
8

Ohh.. So i cant solve this issue ?
Can i try something else ?
Can i config metricbeats for use some other index ? , not metricbeat* which - broken.
Or can i some how purge elastic index ?

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.