# Secure setting is unauthorized

**URL:** <https://discuss.elastic.co/t/secure-setting-is-unauthorized/295264>\
**Category:** Beats\
**Tags:** elastic-stack-security, metricbeat\
**Created:** [January 24, 2022, 5:31pm UTC](https://discuss.elastic.co/t/secure-setting-is-unauthorized/295264 "2022-01-24T17:31:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rachelyang](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rachelyang](https://discuss.elastic.co/u/rachelyang)\
**Post date:** [January 24, 2022, 5:31pm UTC](https://discuss.elastic.co/t/secure-setting-is-unauthorized/295264/1 "2022-01-24T17:31:52Z")

</div>

I tried to use basic authentication credentials in metricbeat.yml  
I set monitor, read\_ilm and read\_pipeline as cluster privileges for role metricbeat\_writer.  
But I got 403 error code. `ERROR	[publisher_pipeline_output]	pipeline/output.go:154	Failed to connect to backoff(elasticsearch(https://localhost:9200)): Connection marked as failed because the onConnect callback failed: error loading template: failed to load template: couldn't load template: 403 Forbidden: {"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:admin/template/put] is unauthorized for user [metricbeat-writer] with roles [metricbeat_writer], this action is granted by the cluster privileges [manage_index_templates,manage,all]"}],"type":"security_exception","reason":"action [indices:admin/template/put] is unauthorized for user [metricbeat-writer] with roles [metricbeat_writer], this action is granted by the cluster privileges [manage_index_templates,manage,all]"},"status":403}. Response body: {"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:admin/template/put] is unauthorized for user [metricbeat-writer] with roles [metricbeat_writer], this action is granted by the cluster privileges [manage_index_templates,manage,all]"}],"type":"security_exception","reason":"action [indices:admin/template/put] is unauthorized for user [metricbeat-writer] with roles [metricbeat_writer], this action is granted by the cluster privileges [manage_index_templates,manage,all]"},"status":403} `

Please help to have a look and let me know if you need any info.

---

<div class="post-metadata">

**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\
**Post date:** [January 24, 2022, 6:27pm UTC](https://discuss.elastic.co/t/secure-setting-is-unauthorized/295264/2 "2022-01-24T18:27:02Z")

</div>

Hi, @rachelyang. After setting up authentication in Elasticsearch, did you restart the service? The error code, 403, has to do with the authentication issue. Are the credentials correct?

There is also the possibility to use keystore to keep the environment more secure.

[Secrets keystore for secure setting](https://www.elastic.co/guide/en/beats/metricbeat/current/keystore.html)

> [@rachelyang](#):
>
> I tried to use basic authentication credentials in metricbeat.yml  
> I set monitor, read\_ilm and read\_pipeline as cluster privileges for role metricbeat\_writer.

---

<div class="post-metadata">

**Author:** ![rachelyang](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rachelyang](https://discuss.elastic.co/u/rachelyang)\
**Post date:** [January 24, 2022, 6:37pm UTC](https://discuss.elastic.co/t/secure-setting-is-unauthorized/295264/3 "2022-01-24T18:37:38Z")

</div>

Hi Wagner,  
Thanks for your reply. I have restarted the metricbeat servicer after I upgraded the version from 7.12.1 to 7.14.1.  
Here is the root cause:  
`this action is granted by the cluster privileges [manage_index_templates,manage,all]`  
But I set cluster privilege to be monitor, read\_ilm and read\_pipeline  
I also tried to use API keys to grant access, it gave me the same error .  
In addition, my credentials are correct.

---

<div class="post-metadata">

**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\
**Post date:** [February 9, 2022, 1:50pm UTC](https://discuss.elastic.co/t/secure-setting-is-unauthorized/295264/4 "2022-02-09T13:50:49Z")

</div>

As I understand it, this is a problem involving a library and that occurs when the update to a more current version is performed. Take a look at this discussion:

> <https://github.com/elastic/beats/issues/29554>
>
> \<!--
> GitHub is reserved for bug reports and feature requests; it is not the pla…ce
> for general questions. If you have a question or an unconfirmed bug , please
> visit the \[forums\](https://discuss.elastic.co/c/elasticsearch). Please also
> check your OS is \[supported\](https://www.elastic.co/support/matrix#show\_os).
> If it is not, the issue is likely to be closed.
> 
> For security vulnerabilities please only send reports to security@elastic.co.
> See https://www.elastic.co/community/security for more information.
> 
> Please fill in the following details to help us reproduce the bug:
> \--\>
> 
> \*\*Elasticsearch version\*\* (\`bin/elasticsearch --version\`): 7.16 (Elastic Cloud)
> 
> \*\*Description of the problem including expected versus actual behavior\*\*:
> 
> After Elasticsearch was upgraded in Elastic Cloud to 7.16, our Functionbeat stopped working. We see following error in our logs:
> 
> \`\`\`
> 2021-12-08T06:42:16.576Z	ERROR	\[publisher\_pipeline\_output\]	pipeline/output.go:154	Failed to connect to backoff(elasticsearch(https://:9243)): Connection marked as failed because the onConnect callback failed: error loading template: failure while checking if template exists: 403 Forbidden: 
> {
> "error": {
> "root\_cause": \[
> {
> "type": "security\_exception",
> "reason": "action \[indices:admin/template/get\] is unauthorized for user \[functionbeat\] with roles \[functionbeat\], this action is granted by the cluster privileges \[manage\_index\_templates,manage,all\]"
> }
> \],
> "type": "security\_exception",
> "reason": "action \[indices:admin/template/get\] is unauthorized for user \[functionbeat\] with roles \[functionbeat\], this action is granted by the cluster privileges \[manage\_index\_templates,manage,all\]"
> },
> "status": 403
> }
> \`\`\`
> 
> This issue can circumvented by adding the \`manage\_index\_templates\` to the role. However, the question is why should Functionbeat need that privilege? Isn't this overly permissive? Why should Functionbeat be able to manage index templates? It's also not mentioned by Functionbeat 7.16 documentation, so I'm not sure whether this functionality is intended.
> 
> \*\*Steps to reproduce\*\*:
> 
> Set up Elasticsearch 7.16 and try to index something with Functionbeat without \`manage\_index\_template\` privilege. Version does not seem to matter.

> [@rachelyang](#):
>
> this action is granted by the cluster privileges [manage\_index\_templates,manage,all

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2022, 3:50pm UTC](https://discuss.elastic.co/t/secure-setting-is-unauthorized/295264/5 "2022-03-09T15:50:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.