Packetbeat Dashboard Help


(David Moreno) #1

Hello Im trying to install a packetbeat dashboard on my ELK server. Im running the command:
packetbeat setup --dashboards

And I get this:
Loading dashboards (Kibana must be running and reachable)
Exiting: Error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory /usr/share/packetbeat/kibana: Failed to import index-pattern: Failed to load directory /usr/share/packetbeat/kibana/6/index-pattern:
error loading /usr/share/packetbeat/kibana/6/index-pattern/packetbeat.json: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];. Response: {"objects":[{"id":"packetbeat-*","type":"index-pattern","error":{"message":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}}]}


(Adrian Serrano) #2

Hi,

This error usually appears because Elasticsearch detects a disk full condition and sets the index to read-only. It seems that sometimes the error condition is not cleared after disk is freed and manual action is required.

See this issue in github for suggested fix:


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.