# Metricbeat errors due to missing manage permission

**URL:** <https://discuss.elastic.co/t/metricbeat-errors-due-to-missing-manage-permission/279867>\
**Category:** Beats\
**Tags:** elastic-stack-security, metricbeat\
**Created:** [July 28, 2021, 1:40pm UTC](https://discuss.elastic.co/t/metricbeat-errors-due-to-missing-manage-permission/279867 "2021-07-28T13:40:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MaximK](https://avatars.discourse-cdn.com/v4/letter/m/3ec8ea/32.png) [@MaximK](https://discuss.elastic.co/u/MaximK)\
**Post date:** [July 28, 2021, 1:40pm UTC](https://discuss.elastic.co/t/metricbeat-errors-due-to-missing-manage-permission/279867/1 "2021-07-28T13:40:40Z")

</div>

Metricbeat configured with user `elastic`  
I have error  
`org.elasticsearch.ElasticsearchSecurityException: action [indices:admin/rollover] is unauthorized for user [remote_monitoring_user] with roles [remote_monitoring_collector,remote_monitoring_agent] on indices [metricbeat-7.13.4,metricbeat-7.13.4-2021.07.28-000001], this action is granted by the index privileges [manage_follow_index,manage,all] at org.elasticsearch.xpack.core.security.support.Exceptions.authorizationError(Exceptions.java:35) ~[x-pack-core-7.13.4.jar:7.13.4]`  
Why metricbeat used `remote_monitoring_user`

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [July 29, 2021, 8:16am UTC](https://discuss.elastic.co/t/metricbeat-errors-due-to-missing-manage-permission/279867/2 "2021-07-29T08:16:47Z")

</div>

This is weird. Do you actually have a user called `remote_monitoring_user`?

Also have a look into [Grant users access to secured resources | Metricbeat Reference [7.13] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/current/feature-roles.html) in case it is helpful.

---

<div class="post-metadata">

**Author:** ![MaximK](https://avatars.discourse-cdn.com/v4/letter/m/3ec8ea/32.png) [@MaximK](https://discuss.elastic.co/u/MaximK)\
**Post date:** [July 29, 2021, 8:49am UTC](https://discuss.elastic.co/t/metricbeat-errors-due-to-missing-manage-permission/279867/3 "2021-07-29T08:49:13Z")

</div>

I have `remote_monitoring_user` after install, but i used `elastic` or try other custom user. My config.

`metricbeat.yml`  
---------------------------- Elasticsearch Output ----------------------------  
output.elasticsearch:  
hosts: ["elk:9200"]  
protocol: "https"  
username: "elastic"  
password: "ADGFAKEGMWELGHKMWREH"

`elasticsearch-xpack.yml`

module: elasticsearch  
xpack.enabled: true  
period: 10s  
hosts: ["elk:9200"]  
username: "elastic"  
password: "ADGFAKEGMWELGHKMWREH"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 26, 2021, 8:49am UTC](https://discuss.elastic.co/t/metricbeat-errors-due-to-missing-manage-permission/279867/4 "2021-08-26T08:49:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.