# Incorrect http method for uri

**URL:** <https://discuss.elastic.co/t/incorrect-http-method-for-uri/348546>\
**Category:** Beats\
**Created:** [December 4, 2023, 10:59am UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri/348546 "2023-12-04T10:59:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![irdrgz](https://avatars.discourse-cdn.com/v4/letter/i/e0b2c6/32.png) [@irdrgz](https://discuss.elastic.co/u/irdrgz)\
**Post date:** [December 4, 2023, 10:59am UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri/348546/1 "2023-12-04T10:59:33Z")

</div>

Hello everyone,

I'm setting up a lab with Security Onion and I'm configuring Auditbeat in an Ubuntu Desktop instance. When I run "auditbeat setup" I get the next error:

![image](https://us1.discourse-cdn.com/elastic/original/3X/3/8/382c2634db85186c4c2a3263e346f455d006da33.jpeg)

Looking for the Kibana logs in the SO machine I get this:

"Incorrect HTTP method for uri [/\_ml/anomaly\_detectors] and method [GET], allowed: [POST]", "status": 405}"

I was trying multiple solutions but none of them works for me. Here you can check my auditbeat.yml file

```auto

Kibana

#Starting with Beats version 6.0.0, the dashboards are loaded via t>
#This requires a Kibana endpoint configuration.
setup.kibana:
host: "192.168. 30. 10:5601"
#Kibana Host
#Scheme and port can be left out and will be set to the default
#In case you specify and additional path, the scheme is required:>
#IPv6 addresses should always be defined as: https://[2001:db8 :: 1>
#host: "localhost: 5601"

#Kibana Space ID
#ID of the Kibana Space into which the dashboards should be loade>
#the Default Space will be used.
#space.id:

Elasticsearch output

output.elasticsearch:

#Array of hosts to connect to.
hosts: ["192.168.30.10:9200"]

#Enabled ilm (beta) to use index lifecycle management instead dai>
#ilm.enabled: false

#Optional protocol and basic auth credentials.
protocol: "https"
ssl.verification_mode: none
username: "XXXX"
password: "XXXX"

```

Kibana is accessible from the browser and all the services are working correctly in SO server.

Thank you all for you help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 1, 2024, 10:59am UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri/348546/2 "2024-01-01T10:59:37Z")

</div>

Closed on January 1, 2024, 10:59am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.