# Unable to bulk\_create index-pattern **URL:** \ **Category:** Beats\ **Tags:** docker, filebeat, metricbeat, auditbeat\ **Created:** [July 15, 2022, 5:03pm UTC](https://discuss.elastic.co/t/unable-to-bulk-create-index-pattern/309754 "2022-07-15T17:03:06Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)\ **Post date:** [July 15, 2022, 5:03pm UTC](https://discuss.elastic.co/t/unable-to-bulk-create-index-pattern/309754/1 "2022-07-15T17:03:06Z")
Hello World! I'm trying to follow these: - [Grant privileges and roles needed for setup | Auditbeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/7.17/privileges-to-setup-beats.html) - [Grant privileges and roles needed for setup | Filebeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.17/privileges-to-setup-beats.html) - [Grant privileges and roles needed for setup | Metricbeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/7.17/privileges-to-setup-beats.html) and yet running into following error (for all of the beats: auditbeat, filebeat and metricbeat) > Unable to bulk\_create index-pattern setup role(s): > GET /\_security/role/auditbeat\_setup ```auto { "auditbeat_setup" : { "cluster" : [ "monitor", "manage_ilm" ], "indices" : [ { "names" : [ "auditbeat-*" ], "privileges" : [ "manage" ], "field_security" : { "grant" : [ "*" ], "except" : [] }, "allow_restricted_indices" : false }, { "names" : [ "auditbeat-*" ], "privileges" : [ "write" ], "field_security" : { "grant" : [ "*" ] }, "allow_restricted_indices" : false } ], "applications" : [], "run_as" : [], "metadata" : { }, "transient_metadata" : { "enabled" : true } } } ``` > GET /\_security/role/filebeat\_setup ```auto { "filebeat_setup" : { "cluster" : [ "monitor", "manage_ilm", "manage_ml" ], "indices" : [ { "names" : [ "filebeat-*" ], "privileges" : [ "manage", "write", "read" ], "field_security" : { "grant" : [ "*" ], "except" : [] }, "allow_restricted_indices" : false } ], "applications" : [], "run_as" : [], "metadata" : { }, "transient_metadata" : { "enabled" : true } } } ``` > GET /\_security/role/metricbeat\_setup ```auto { "metricbeat_setup" : { "cluster" : [ "monitor", "manage_ilm" ], "indices" : [ { "names" : [ "metricbeat-*" ], "privileges" : [ "manage" ], "field_security" : { "grant" : [ "*" ], "except" : [] }, "allow_restricted_indices" : false } ], "applications" : [], "run_as" : [], "metadata" : { }, "transient_metadata" : { "enabled" : true } } } ``` user(s) w/ setup role and several others: > GET /\_security/user/auditbeat ```auto { "auditbeat" : { "username" : "auditbeat", "roles" : [ "auditbeat_setup", "kibana_admin", "ingest_admin" ], "full_name" : "X", "email" : "X@X.X", "metadata" : { }, "enabled" : true } } ``` > GET /\_security/user/filebeat ```auto { "filebeat" : { "username" : "filebeat", "roles" : [ "filebeat_setup", "kibana_admin", "ingest_admin", "machine_learning_admin" ], "full_name" : "X", "email" : "X@X.X", "metadata" : { }, "enabled" : true } } ``` > GET /\_security/user/metricbeat ```auto { "metricbeat" : { "username" : "metricbeat", "roles" : [ "kibana_admin", "ingest_admin", "metricbeat_setup" ], "full_name" : "X", "email" : "X@X.X", "metadata" : { }, "enabled" : true } } ``` the actual error: _auditbeat_: ```auto root@647411e7353a:/usr/share/auditbeat# auditbeat setup -e -E setup.kibana.host=https://X.X.X:5601 ... 2022-07-15T16:50:36.433Z ERROR instance/beat.go:1014 Exiting: 1 error: error loading index pattern: returned 403 to import file: Unable to bulk_create index-pattern: . Response: {"statusCode":403,"error":"Forbidden","message":"Unable to bulk_create index-pattern"} Exiting: 1 error: error loading index pattern: returned 403 to import file: Unable to bulk_create index-pattern: . Response: {"statusCode":403,"error":"Forbidden","message":"Unable to bulk_create index-pattern"} ``` _filebeat_: ```auto root@6fd37f1e7d0a:/usr/share/filebeat# filebeat setup -e -E setup.kibana.host=https://X.X.X:5601 ... 2022-07-15T17:18:22.539Z ERROR instance/beat.go:1014 Exiting: 1 error: error loading index pattern: returned 403 to import file: Unable to bulk_create : . Response: {"statusCode":403,"error":"Forbidden","message":"Unable to bulk_create "} Exiting: 1 error: error loading index pattern: returned 403 to import file: Unable to bulk_create : . Response: {"statusCode":403,"error":"Forbidden","message":"Unable to bulk_create "} ``` _metricbeat_: ```auto root@2a22d73960da:/usr/share/metricbeat# metricbeat setup -e -E setup.kibana.host=https://X.X.X:5601 ... 2022-07-15T17:17:37.951Z ERROR instance/beat.go:1014 Exiting: 1 error: error loading index pattern: returned 403 to import file: Unable to bulk_create index-pattern: . Response: {"statusCode":403,"error":"Forbidden","message":"Unable to bulk_create index-pattern"} Exiting: 1 error: error loading index pattern: returned 403 to import file: Unable to bulk_create index-pattern: . Response: {"statusCode":403,"error":"Forbidden","message":"Unable to bulk_create index-pattern"} ``` Please advise) Thank you in advance! ---
**Author:** ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)\ **Post date:** [July 15, 2022, 8:48pm UTC](https://discuss.elastic.co/t/unable-to-bulk-create-index-pattern/309754/2 "2022-07-15T20:48:10Z")
I also have noticed these message in Kibana logs: _auditbeat_: ```auto ... auditbeat unauthorized to [checkConflicts] [index-pattern] in [default]: missing [(default)saved_object:7.17.4:index-pattern/bulk_create] X | {"type":"response","@timestamp":"2022-07-15T20:45:35+00:00","tags":[],"pid":7,"method":"post","statusCode":403,"req":{"url":"/api/saved_objects/_import?overwrite=true","method":"post","headers":{"host":"X:5601","user-agent":"Elastic-auditbeat/7.17.4 (linux; amd64; ea28c0419dc4ede9318c4b34a732ce11b03482b7; 2022-05-18 16:41:24 +0000 UTC)","content-length":"312355","accept":"application/json","content-type":"multipart/form-data; boundary=65fd638059e32bbcdfba46aeecb482b4fb260b686dfb736ecb814c204b3e","kbn-xsrf":"1","accept-encoding":"gzip"},"remoteAddress":"192.168.160.3","userAgent":"Elastic-auditbeat/7.17.4 (linux; amd64; ea28c0419dc4ede9318c4b34a732ce11b03482b7; 2022-05-18 16:41:24 +0000 UTC)"},"res":{"statusCode":403,"responseTime":146,"contentLength":86},"message":"POST /api/saved_objects/_import?overwrite=true 403 146ms - 86.0B"} ``` _filebeat_: ```auto ...filebeat unauthorized to [checkConflicts] [index-pattern] in [default]: missing []"} X | {"type":"response","@timestamp":"2022-07-15T20:50:36+00:00","tags":[],"pid":7,"method":"post","statusCode":403,"req":{"url":"/api/saved_objects/_import?overwrite=true","method":"post","headers":{"host":"X:5601","user-agent":"Elastic-filebeat/7.17.4 (linux; amd64; ea28c0419dc4ede9318c4b34a732ce11b03482b7; 2022-05-18 16:46:57 +0000 UTC)","content-length":"1260576","accept":"application/json","content-type":"multipart/form-data; boundary=176be3ef0e2d1428001e20a7ce25787e903c3116afe0692951cab626621f","kbn-xsrf":"1","accept-encoding":"gzip"},"remoteAddress":"192.168.160.4","userAgent":"Elastic-filebeat/7.17.4 (linux; amd64; ea28c0419dc4ede9318c4b34a732ce11b03482b7; 2022-05-18 16:46:57 +0000 UTC)"},"res":{"statusCode":403,"responseTime":388,"contentLength":73},"message":"POST /api/saved_objects/_import?overwrite=true 403 388ms - 73.0B"} ``` _metricbeat_: ```auto ... metricbeat unauthorized to [checkConflicts] [index-pattern] in [default]: missing [(default)saved_object:7.17.4:index-pattern/bulk_create]"} X | {"type":"response","@timestamp":"2022-07-15T20:52:09+00:00","tags":[],"pid":7,"method":"post","statusCode":403,"req":{"url":"/api/saved_objects/_import?overwrite=true","method":"post","headers":{"host":"X.X.X:5601","user-agent":"Elastic-metricbeat/7.17.4 (linux; amd64; ea28c0419dc4ede9318c4b34a732ce11b03482b7; 2022-05-18 16:59:13 +0000 UTC)","content-length":"1034480","accept":"application/json","content-type":"multipart/form-data; boundary=55c248cdeff896ea44e38658e971f60fcbc381bb054f40de7a860bec4d86","kbn-xsrf":"1","accept-encoding":"gzip"},"remoteAddress":"192.168.160.5","userAgent":"Elastic-metricbeat/7.17.4 (linux; amd64; ea28c0419dc4ede9318c4b34a732ce11b03482b7; 2022-05-18 16:59:13 +0000 UTC)"},"res":{"statusCode":403,"responseTime":237,"contentLength":86},"message":"POST /api/saved_objects/_import?overwrite=true 403 237ms - 86.0B"} ``` ```auto ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 12, 2022, 10:48pm UTC](https://discuss.elastic.co/t/unable-to-bulk-create-index-pattern/309754/3 "2022-08-12T22:48:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.