# Unable to update ui setting request failed with status code: 429

**URL:** <https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-429/290001>\
**Category:** Kibana\
**Tags:** docker\
**Created:** [November 24, 2021, 1:26am UTC](https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-429/290001 "2021-11-24T01:26:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ftester](https://avatars.discourse-cdn.com/v4/letter/f/f08c70/32.png) [@ftester](https://discuss.elastic.co/u/ftester)\
**Post date:** [November 24, 2021, 1:26am UTC](https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-429/290001/1 "2021-11-24T01:26:13Z")

</div>

Hello guys,

#### The Scinario:

I have 4 dockers, elasticsearch, kibana, filebeat, dvwa.  
So basically, I should attack dvwa and see the apache logs on kibana dashboard.

I use Ubuntu server 20.4 to set up the docker on it and it's a virtual machine on vbox  
for the attacking, I use Kali Linux.

#### What happened before the problem:

after I set up the Ubuntu server on virtual box (vbox),  
I used a similar installation script but has some more apt update and docker installation commands and everything it was working fine, I can access my elasticsearch, I can see the Access and error logs ECS - Filebeat Apache module dashboard.

Then I used this removing script:

```auto
#!/usr/bin/env bash
set -e

echo -e "\e[34m {+} Stop and remove all containers \e[0m"
docker stop elasticsearch kibana dvwa filebeat
docker rm elasticsearch kibana dvwa filebeat

echo -e "\e[34m {+} Remove all images \e[0m"
docker image rm vulnerables/web-dvwa docker.elastic.co/beats/filebeat:7.15.2 docker.elastic.co/kibana/kibana:7.15.2 docker.elastic.co/elasticsearch/elasticsearch:7.15.2 -f

echo -e "\e[36m The End\e[0m"

```

After the removing I powered off the vm and I started again, and I used the next installation script.

#### The installation:

I used this script to install the images and start the containers and link everything and configure it.

NOTE: The configuration file (filebeat.yml) in the configure the filebeat step, it's already on the system so it's not missed.

```auto
echo -e "\e[34m {+} Wait for 3 minutes\e[0m"
sleep 180

echo -e "\e[34m {+} Start Filebeat and connect it with Kibana\e[0m"
docker run -it \
--link elasticsearch --link kibana \
docker.elastic.co/beats/filebeat:7.15.2 \
setup -E setup.kibana.host=kibana:5601 \
-E output.elasticsearch.hosts=["elasticsearch:9200"]

echo -e "\e[34m {+} Wait for 3 minutes\e[0m"
sleep 180

echo -e "\e[34m {+} Configure the Filebeat with the filebeat.yml file\e[0m"
docker run -d \
  --link elasticsearch --link kibana \
  --name=filebeat \
  --user=root \
  --volume="$(pwd)/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro" \
  --volume="/var/lib/docker/containers:/var/lib/docker/containers:ro" \
  --volume="/var/run/docker.sock:/var/run/docker.sock:ro" \
  docker.elastic.co/beats/filebeat:7.15.2 filebeat -e -strict.perms=false \
  -E output.elasticsearch.hosts=["elasticsearch:9200"]
  
echo -e "\e[34m {+} Wait for 3 minutes\e[0m"
sleep 180

echo -e "\e[34m {+} Customize the configuration and start DVWA docker\e[0m"
docker run \
  --label co.elastic.logs/module=apache2 \
  --label co.elastic.logs/fileset.stdout=access \
  --label co.elastic.logs/fileset.stderr=error \
  --label co.elastic.metrics/module=apache \
  --label co.elastic.metrics/metricsets=status \
  --label co.elastic.metrics/hosts='${data.host}:${data.port}' \
  --detach=true \
  --name dvwa \
  -p 80:80 \
  vulnerables/web-dvwa

echo -e "\e[34m {+} Check the running containers\e[0m"
docker ps

echo -e "\e[36m The End\e[0m"

```

After this, I can see the Overview under Security and I can see the events there,  
but when I try to go to "Access and error logs ECS - Filebeat Apache module dashboard."  
All I see is 'Error' all around and  
'Unable to update UI Settings  
Request failed with status code: 429'

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/0/3/039d21d96c818bb9af4cb6f7f467de7b7dea40e6.png)

#### What I tried to do?

I already know that code 429 should be something related to the disk usage exceeded flood-stage watermark, index has read-only-allow-delete block, but I didn't see this error.  
Also, I tried to check the cluster and everything and is not really that obvious which one I should delete or what I should exactly.

I hope you can help me guys and I hope I made this clear as possible.  
Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 24, 2021, 1:30am UTC](https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-429/290001/2 "2021-11-24T01:30:31Z")

</div>

Welcome to our community! 😃 We aren't all guys though 🙂

What does a request to the Elasticsearch IP on port 9200 show you?

---

<div class="post-metadata">

**Author:** ![ftester](https://avatars.discourse-cdn.com/v4/letter/f/f08c70/32.png) [@ftester](https://discuss.elastic.co/u/ftester)\
**Post date:** [November 24, 2021, 1:40am UTC](https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-429/290001/3 "2021-11-24T01:40:04Z")

</div>

Sorry, I didn't understand what you mean.  
Can you please explain more?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 24, 2021, 1:41am UTC](https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-429/290001/4 "2021-11-24T01:41:18Z")

</div>

Can you `curl elasticsearch-IP-or-hostname:9200`

---

<div class="post-metadata">

**Author:** ![ftester](https://avatars.discourse-cdn.com/v4/letter/f/f08c70/32.png) [@ftester](https://discuss.elastic.co/u/ftester)\
**Post date:** [November 25, 2021, 4:12pm UTC](https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-429/290001/5 "2021-11-25T16:12:29Z")

</div>

Hi,  
Thanks for explaning.

This is the results when I curl Elasticsearch:9200

```auto
  "name" : "f160eca8736b",
  "cluster_name" : "docker-cluster",
  "cluster_uuid" : "x9oLAF4YTQiUp3iieH5d8A",
  "version" : {
    "number" : "7.15.2",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "93d5a7f6192e8a1a12e154a2b81bf6fa7309da0c",
    "build_date" : "2021-11-04T14:04:42.515624022Z",
    "build_snapshot" : false,
    "lucene_version" : "8.9.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 25, 2021, 10:59pm UTC](https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-429/290001/6 "2021-11-25T22:59:19Z")

</div>

Ok, a 429 usually means you are overloading Elasticsearch.

Is there anything in the Elasticsearch logs at the time of this Kibana issue?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2021, 10:59pm UTC](https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-429/290001/7 "2021-12-23T22:59:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.