# Kibana error fetching fields for index pattern

**URL:** <https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725>\
**Category:** Kibana\
**Created:** [July 27, 2020, 9:42am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725 "2020-07-27T09:42:30Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tuckson](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tuckson](https://discuss.elastic.co/u/Tuckson)\
**Post date:** [July 27, 2020, 9:42am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/1 "2020-07-27T09:42:31Z")

</div>

Hi,

Have seen this question pass by several times, however yet I have found no solution.  
I have this ELK 7.7 stack. I try to index a log file and view the reults in Kibana.

I have quite a default kibana installation and have not enabled security .

However when I try to fetch data, I get the error: fetching fields for index pattern xxxx forbidden.

What is forbidden, why is it forbidden (since not enabled security) en how die I fix that?

Regards

edit:  
The full error as copied from the error popup:

```auto
Wrapper@https://kibana.srv/bundles/commons.bundle.js:3:4001561
HttpFetchError@https://kibana.srv/bundles/commons.bundle.js:3:4003311
_callee3$@https://kibana.srv/bundles/commons.bundle.js:3:3997981
l@https://kibana.srv/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970404
s/o._invoke</<@https://kibana.srv/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970159
_/</e[t]@https://kibana.srv/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970758
asyncGeneratorStep@https://kibana.srv/bundles/commons.bundle.js:3:3991496
_next@https://kibana.srv/bundles/commons.bundle.js:3:3991815
Q/<@https://kibana.srv/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:938246
r@https://kibana.srv/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:283:27572

```

---

<div class="post-metadata">

**Author:** ![Tuckson](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tuckson](https://discuss.elastic.co/u/Tuckson)\
**Post date:** [July 27, 2020, 2:09pm UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/2 "2020-07-27T14:09:38Z")

</div>

Proper filtering in logstash was not in place, so kibana made it's own choices appaerantly. It helped to place the correct conf in /etc/logstash/conf.d

---

<div class="post-metadata">

**Author:** ![Tuckson](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tuckson](https://discuss.elastic.co/u/Tuckson)\
**Post date:** [August 4, 2020, 2:13pm UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/3 "2020-08-04T14:13:54Z")

</div>

Wel, I removed my own solutionmark, since I still get the error.

The latest one:

```auto
Error fetching fields for index pattern index1-* (ID: d99abc40-cdb6-11ea-b35e-cdfa03767e2c)

    Forbidden

```

A click on "see the full error" gives:

```auto
_construct@https://kibana.srv/bundles/commons.bundle.js:3:4002451
Wrapper@https://kibana.srv/bundles/commons.bundle.js:3:4001561
HttpFetchError@https://kibana.srv/bundles/commons.bundle.js:3:4003311
_callee3$@https://kibana.srv/bundles/commons.bundle.js:3:3997981
l@https://kibana.srv/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970404
s/o._invoke</<@https://kibana.srv/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970159
_/</e[t]@https://kibana.srv/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970758
asyncGeneratorStep@https://kibana.srv/bundles/commons.bundle.js:3:3991496
_next@https://kibana.srv/bundles/commons.bundle.js:3:3991815
Q/<@https://kibana.srv/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:938246
r@https://kibana.srv/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:283:27572

```

What might cause this? Never saw this on 6.x?

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [August 4, 2020, 3:22pm UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/4 "2020-08-04T15:22:48Z")

</div>

Have you looked at your elasticsearch config? I suspect there's a permissions issue.

---

<div class="post-metadata">

**Author:** ![Tuckson](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tuckson](https://discuss.elastic.co/u/Tuckson)\
**Post date:** [August 5, 2020, 2:34pm UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/5 "2020-08-05T14:34:46Z")

</div>

EHmm... But what should I look at? I did not set any security at all,other d=than an nginx in front to go through ldap.

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [August 5, 2020, 2:39pm UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/6 "2020-08-05T14:39:51Z")

</div>

Perhaps it would be helpful to look at kibana and elasticsearch logs for errors.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [August 5, 2020, 2:40pm UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/7 "2020-08-05T14:40:00Z")

</div>

If you go to Management -\> Index Patterns and open index1-\* do you get an error or can see the index pattern?

---

<div class="post-metadata">

**Author:** ![Tuckson](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tuckson](https://discuss.elastic.co/u/Tuckson)\
**Post date:** [August 6, 2020, 9:04am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/8 "2020-08-06T09:04:53Z")

</div>

I see the index pattern

---

<div class="post-metadata">

**Author:** ![umay\_fb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/umay_fb/32/60582_2.png) [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\
**Post date:** [August 6, 2020, 9:24am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/9 "2020-08-06T09:24:00Z")

</div>

i get same issue. when i want to update, create, delete the index pattern i get error like bellow. its error in .kibana index? but when i save a visualization or dashboard its run normal without any error. i had see log in kibana.log and elastic, but i didnt find the error .

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/6/2655e64ad76fa0d5ceffee5d8df8276f7d7cc412.png)

---

<div class="post-metadata">

**Author:** ![Tuckson](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tuckson](https://discuss.elastic.co/u/Tuckson)\
**Post date:** [August 6, 2020, 9:32am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/10 "2020-08-06T09:32:05Z")

</div>

> Perhaps it would be helpful to look at kibana and elasticsearch logs for errors.

Checked kibana.log and the elasticsearch.log and server.json of the node kibana connects to. Both show no errors in the logs.

It must be something in my setup since I have 2 clusters which are setup the same way and both show this error.

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [August 6, 2020, 3:30pm UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/11 "2020-08-06T15:30:57Z")

</div>

@Tuckson could you post a har file with the error? I'm still not certain where the specific error is occuring.

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [August 6, 2020, 3:34pm UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/12 "2020-08-06T15:34:46Z")

</div>

@umay_fb I think you have a different problem from Tuckson. Could you post a har file with the error? I see a number of errors in your screenshot - the unexpected token, a failure to load js, and a 501 error. Any or all of these may be related or unrelated.

---

<div class="post-metadata">

**Author:** ![umay\_fb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/umay_fb/32/60582_2.png) [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\
**Post date:** [August 7, 2020, 3:16am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/13 "2020-08-07T03:16:12Z")

</div>

```
"response": {
                    "status": 501,
                    "statusText": "",
                    "httpVersion": "http/2.0",
                    "headers": [
                        {
                            "name": "status",
                            "value": "501"
                        },
                        {
                            "name": "server",
                            "value": "AkamaiGHost"
                        },
                        {
                            "name": "mime-version",
                            "value": "1.0"
                        },
                        {
                            "name": "content-type",
                            "value": "text/html"
                        },
                        {
                            "name": "content-length",
                            "value": "366"
                        },
                        {
                            "name": "expires",
                            "value": "Fri, 07 Aug 2020 02:06:30 GMT"
                        },
                        {
                            "name": "date",
                            "value": "Fri, 07 Aug 2020 02:06:30 GMT"
                        }
                    ],
                    "cookies": [],
                    "content": {
                        "size": 366,
                        "mimeType": "text/html"
                    },
                    "redirectURL": "",
                    "headersSize": -1,
                    "bodySize": -1,
                    "_transferSize": 488,
                    "_error": null
                },
                "serverIPAddress": "119.110.115.144",
                "startedDateTime": "2020-08-07T02:06:31.238Z",
                "time": 40.0919999810867,
                "timings": {
                    "blocked": 5.254999973088503,
                    "dns": -1,
                    "ssl": -1,
                    "connect": -1,
                    "send": 0.7010000000000001,
                    "wait": 31.378000020191074,
                    "receive": 2.757999987807125,
                    "_blocked_queueing": 2.778999973088503,
                    "_blocked_proxy": 0.5209999999999999
                }
            }
        ]
    }
}

```

here my har, sorry cause for lmit post only 13000 char i just post the response. its 501 error, is it error in server? but if in server why this error only appear when i create, delete and update index pattern?

---

<div class="post-metadata">

**Author:** ![Tuckson](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tuckson](https://discuss.elastic.co/u/Tuckson)\
**Post date:** [August 7, 2020, 7:27am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/14 "2020-08-07T07:27:09Z")

</div>

Umay,

It is not very nice to jihack someones topic for your own questions when the original question has not been solved yet. It's also against the forumrules (See [FAQ](https://discuss.elastic.co/faq)). Please be so kind as to open a seperate topic for your question.

---

<div class="post-metadata">

**Author:** ![Tuckson](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tuckson](https://discuss.elastic.co/u/Tuckson)\
**Post date:** [August 7, 2020, 7:28am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/15 "2020-08-07T07:28:55Z")

</div>

Well, need to figure out how to post an attachment here...

In the mean time: currently running on ES & kibana 7.8.1, CentOS Linux release 7.8.2003 (Core)

Edit: Please find the har file (for a limited time under [this link](http://houtjes.nl/har.zip), since I seem not to be able to post files here.

Edit2:Since I wondered it might be something with filepermissions I checked those on my db's and kibana server. I did not find anything that made me wonder that cloud be the cause.

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [August 7, 2020, 4:31pm UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/16 "2020-08-07T16:31:13Z")

</div>

I can tell you're attempting to connect to your sever through Akamai. It would be good to try hitting it directly. Also, I can't see the request being made. You can use [https://gist.github.com/](https://gist.github.com/) for sharing data.

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [August 7, 2020, 4:37pm UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/17 "2020-08-07T16:37:24Z")

</div>

Are you using a proxy of any sort? I see a couple of 401 errors that contain correct responses. I'm not sure why that would happen. I see an nginx error when attempting to update the index pattern field list.

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [August 7, 2020, 6:31pm UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/18 "2020-08-07T18:31:29Z")

</div>

Agreed, generally I don't mind but its probably playing havoc with notifications.

---

<div class="post-metadata">

**Author:** ![Tuckson](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tuckson](https://discuss.elastic.co/u/Tuckson)\
**Post date:** [September 3, 2020, 11:27am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/19 "2020-09-03T11:27:13Z")

</div>

OK.

Issue solved.  
Elastic has renamed a lot of fields when going from 6 to 7. Among these fields in 6 was also the 'beats' object which is partly replaced by the 'agent' object in 7.

However in the logstash filter the beats.name, beats.hostname en beats.version were specifically mapped to have them visible in our listings.

I changed this to proper names, pushed the configs en reindexed the bunch.

And now the error is gone.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2020, 11:27am UTC](https://discuss.elastic.co/t/kibana-error-fetching-fields-for-index-pattern/242725/20 "2020-10-01T11:27:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.