# Metricbeat:action \[indices:admin/auto\_create\] is unauthorized for user \[metricbeat\] with effective roles \[ES\_metricbeat\] on indices \[metricbeat-8.6.2\], this action is granted by the index privileges **URL:** \ **Category:** Elasticsearch\ **Created:** [March 27, 2023, 7:54pm UTC](https://discuss.elastic.co/t/metricbeat-action-indices-admin-auto-create-is-unauthorized-for-user-metricbeat-with-effective-roles-es-metricbeat-on-indices-metricbeat-8-6-2-this-action-is-granted-by-the-index-privileges/328648 "2023-03-27T19:54:33Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Tussingh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tussingh/32/116802_2.png) [@Tussingh](https://discuss.elastic.co/u/Tussingh)\ **Post date:** [March 27, 2023, 7:54pm UTC](https://discuss.elastic.co/t/metricbeat-action-indices-admin-auto-create-is-unauthorized-for-user-metricbeat-with-effective-roles-es-metricbeat-on-indices-metricbeat-8-6-2-this-action-is-granted-by-the-index-privileges/328648/1 "2023-03-27T19:54:33Z")
I am facing error in ingesting data from metricbeat to elastic. Please help {"log.level":"warn","@timestamp":"2023-03-28T01:22:21.499+0530","log.logger":"elasticsearch","log.origin":{"file.name":"elasticsearch/client.go","file.line":429},"message":" **Cannot index event publisher**.Event{Content:beat.Event{Timestamp:time.Date(2023, time.March, 28, 1, 22, 17, 316634000, time.Local), Meta:null, Fields:{"agent":{"ephemeral\_id":"afdad20d-3925-4e25-b548-4d6ab475119b","id":"0d00c413-7ee6-46a9-a207-ffcbb2e3cc30","name":"Seemas-Mac-mini.local","type":"metricbeat","version":"8.6.2"},"ecs":{"version":"8.0.0"},"error":{"message":"error fetching status: error making http request: Get \"[http://127.0.0.1/nginx\_status\\\](http://127.0.0.1/nginx_status%5C%5C%5C)": dial tcp 127.0.0.1:80: connect: connection refused"},"event":{"dataset":"nginx.stubstatus","duration":1557542,"module":"nginx"},"host":{"architecture":"x86\_64","hostname":"Seemas-Mac-mini.local","id":"BAD1E8D2-C9D6-55B6-BF16-659E510C1960","ip":["fe80::6455:6cff:fe31:930c","fe80::6455:6cff:fe31:930b","fe80::479:b1fa:6768:f61","192.168.0.106","2406:7400:63:d154:cb9:8d6c:21c0:bd17","2406:7400:63:d154:381b:7f50:a2cb:e3f0","fe80::412:bff:fedc:c129","fe80::412:bff:fedc:c129","fe80::ddb9:5093:4eb6:5c8c","fe80::6f42:78a2:e899:91f5","fe80::ce81:b1c:bd2c:69e"],"mac":["06-12-0B-DC-C1-29","14-98-77-58-47-D6","14-98-77-5C-E8-C5","36-3C-AE-F3-9F-00","36-3C-AE-F3-9F-04","36-98-77-58-47-D6","66-55-6C-31-93-0B","66-55-6C-31-93-0C","66-55-6C-31-93-EB","66-55-6C-31-93-EC"],"name":"Seemas-Mac-mini.local","os":{"build":"22A400","family":"darwin","kernel":"22.1.0","name":"macOS","platform":"darwin","type":"macos","version":"13.0.1"}},"metricset":{"name":"stubstatus","period":10000},"service":{"address":"[http://127.0.0.1/nginx\_status\",\"type\":\"nginx\](http://127.0.0.1/nginx_status%5C%22,%5C%22type%5C%22:%5C%22nginx%5C)"}}, Private:interface {}(nil), TimeSeries:true}, Flags:0x0, Cache:publisher.EventCache{m:mapstr.M(nil)}} (status=403): {"type":"security\_exception","reason":"**action [indices:admin/auto\_create] is unauthorized for user [metricbeat] with effective roles [ES\_metricbeat] on indices [metricbeat-8.6.2], this action is granted by the index privileges [auto\_configure,create\_index,manage,all]"}, dropping event!","service.name":"metricbeat","ecs.version":"1.6.0"}** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 24, 2023, 7:55pm UTC](https://discuss.elastic.co/t/metricbeat-action-indices-admin-auto-create-is-unauthorized-for-user-metricbeat-with-effective-roles-es-metricbeat-on-indices-metricbeat-8-6-2-this-action-is-granted-by-the-index-privileges/328648/2 "2023-04-24T19:55:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.