# Service Unavailable for \[audit\]beat

**URL:** <https://discuss.elastic.co/t/service-unavailable-for-audit-beat/221398>\
**Category:** Elasticsearch\
**Created:** [February 28, 2020, 10:22am UTC](https://discuss.elastic.co/t/service-unavailable-for-audit-beat/221398 "2020-02-28T10:22:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [February 28, 2020, 10:22am UTC](https://discuss.elastic.co/t/service-unavailable-for-audit-beat/221398/1 "2020-02-28T10:22:06Z")

</div>

Attempting to install an audibeat on a Linux End Point - EP. But it eludes me why it fails to output to my cluster.

2020-02-28T11:07:55.196+0100 DEBUG [elasticsearch] elasticsearch/client.go:737 Ping request failed with: Get https://: Service Unavailable

See Issue tracked further in [Auditbeat discussion fora](https://discuss.elastic.co/t/auditbeat-vs-testing-es-output/221252/4)

---

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [March 3, 2020, 7:52am UTC](https://discuss.elastic.co/t/service-unavailable-for-audit-beat/221398/2 "2020-03-03T07:52:45Z")

</div>

Anyone?

I'm puzzled by this, user attempted with has a role which got create\_index,index,write on auditbeat-\* same role which work for another user working for Windows auditbeats.

'Service unavailable' wouldn't that possible imply some kind of permission issue on elastic side, and if how to get details logged somehow?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 31, 2020, 7:52am UTC](https://discuss.elastic.co/t/service-unavailable-for-audit-beat/221398/3 "2020-03-31T07:52:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
