# Metricbeat WARN Cannot index event

**URL:** https://discuss.elastic.co/t/metricbeat-warn-cannot-index-event/234212
**Category:** Beats
**Tags:** metricbeat
**Created:** [May 25, 2020, 8:44pm UTC](https://discuss.elastic.co/t/metricbeat-warn-cannot-index-event/234212 "2020-05-25T20:44:09Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![lrabbade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lrabbade/32/69032_2.png) [@lrabbade](https://discuss.elastic.co/u/lrabbade)
#### Post date: [May 25, 2020, 8:44pm UTC](https://discuss.elastic.co/t/metricbeat-warn-cannot-index-event/234212/1 "2020-05-25T20:44:09Z")

</div>

I've seen a few posts like this, but none of them solved my problem, so:

I created a elastic cluster following this tutorial: [https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls-docker.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls-docker.html)

I've set the built in passwords, and I can reach elasticsearch

```auto
$ curl -k --user elastic:$ELASTIC_PWD https://localhost:9200/
{
  "name" : "es01",
  "cluster_name" : "docker-cluster",
  "cluster_uuid" : "hqrGkTUGR0W2Clsaxp75pQ",
  "version" : {
    "number" : "7.6.2",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "ef48eb35cf30adf4db14086e8aabd07ef6fb113f",
    "build_date" : "2020-03-26T06:34:37.794943Z",
    "build_snapshot" : false,
    "lucene_version" : "8.4.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

```

I copied the certificate authority to the host machine (where I will be running metricbeat) as follows:

```auto
sudo -s
mkdir -p /etc/pki/root
docker exec kibana cat /usr/share/elasticsearch/config/certificates/ca/ca.crt > /etc/pki/root/ca.pem

```

I can check the certificate is there:

```auto
$ cat /etc/pki/root/ca.pem
-----BEGIN CERTIFICATE-----
<certificate>
-----END CERTIFICATE-----

```

So far so good, then, I installed metricbeat following this tutorial:  
[https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-installation.html](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-installation.html)

And set the following configs at `/etc/metricbeat/metricbeat.yml`:

```auto
setup.kibana:
  host: "https://localhost:5601"
  ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

output.elasticsearch:
  hosts: ["https://localhost:9200"]
  username: "metricbeat"
  password: "<password>"
  ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

```

The `metricbeat` user I've created in Kibana following this:  
[https://www.elastic.co/guide/en/beats/metricbeat/current/feature-roles.html](https://www.elastic.co/guide/en/beats/metricbeat/current/feature-roles.html)

Basically, I created a role called `metricbeat_setup` with cluster privileges `monitor` and `manage_ilm` and index privilege `manage` on `metricbeat-*`, then, I created the `metricbeat` user with roles `metricbeat_setup`, `kibana_admin`, `ingest_admin`, `beats_admin`, `beats_system`

I think my problem might be here, I didn't quite understand the necessary permissions so I just went overkill, anyway, continuing...

I ran the setup `sudo metricbeat setup -e` and everything went fine, no errors in setup, then I started it with `sudo service metricbeat start`, but nothing gets to elasticsearch, and when I look at `sudo service metricbeat status`, I get multiple lines of `WARN Cannot index event`

I tried to look at the logs in `/var/log/metricbeat/` but found nothing useful there, also in elasticsearch logs in docker, no useful information as well.

The metricbeat-\* index is created and the shard is allocated:

```auto
$ curl -k --user elastic:$ELASTIC_PWD https://localhost:9200/_cat/indices/metricbeat-*?pretty
green open metricbeat-7.7.0-2020.05.25-000001 p_0nuiX1S8SARk9QZK01EA 1 1 0 0 566b 283b

```

```auto
$ curl -k --user elastic:$ELASTIC_PWD https://localhost:9200/_cluster/allocation/explain?pretty
{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "unable to find any unassigned shards to explain [ClusterAllocationExplainRequest[useAnyUnassignedShard=true,includeYesDecisions?=false]"
      }
    ],
    "type" : "illegal_argument_exception",
    "reason" : "unable to find any unassigned shards to explain [ClusterAllocationExplainRequest[useAnyUnassignedShard=true,includeYesDecisions?=false]"
  },
  "status" : 400
}

```

So, please, what am I missing here? I can't find any relevant information in logs or in posts, I've seen posts here saying this was related to lack of disk space, I have 14G free, so I guess that's not the problem. Also, I know metricbeat can connect to both elasticsearch and kibana, because it was able to create the index and the dashboard, I can open the dashboard in kibana but there's no data.

What am I doing wrong?

Thank you

---

<div class="post-metadata">

### Author: ![Alex\_Kristiansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_kristiansen/32/46086_2.png) [@Alex\_Kristiansen](https://discuss.elastic.co/u/Alex_Kristiansen)
#### Post date: [May 29, 2020, 8:16pm UTC](https://discuss.elastic.co/t/metricbeat-warn-cannot-index-event/234212/2 "2020-05-29T20:16:56Z")

</div>

@lrabbade,

Can you post the output of the following `CAT` APIs?

`/_cat/indices`

`/_cat/shards`

`/cat/health`

Also, it may help if you enable debug logging in metricbeat via the `logging.level` flag. If there's any errors reported at the debug level, could you paste them as well?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 26, 2020, 8:16pm UTC](https://discuss.elastic.co/t/metricbeat-warn-cannot-index-event/234212/3 "2020-06-26T20:16:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.