# What causes the 403 template error?

**URL:** <https://discuss.elastic.co/t/what-causes-the-403-template-error/34541>\
**Category:** Logstash\
**Created:** [November 13, 2015, 5:41pm UTC](https://discuss.elastic.co/t/what-causes-the-403-template-error/34541 "2015-11-13T17:41:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![iamthealex](https://avatars.discourse-cdn.com/v4/letter/i/e9c0ed/32.png) [@iamthealex](https://discuss.elastic.co/u/iamthealex)\
**Post date:** [November 13, 2015, 5:41pm UTC](https://discuss.elastic.co/t/what-causes-the-403-template-error/34541/1 "2015-11-13T17:41:45Z")

</div>

$ bin/logstash -f httpin.conf  
Default settings used: Filter workers: 2  
Failed to install template: [403] {"error":{"root\_cause":[{"type":"security\_exception","reason":"action [indices:admin/template/get] is unauthorized for user [logstash]"}],"type":"security\_exception","reason":"action [indices:admin/template/get] is unauthorized for user [logstash]"},"status":403} {:level=\>:error}  
Logstash startup completed

Here is the elasticsearch output config from 'httpin.conf'

elasticsearch {  
hosts =\>"0ea8f6xxxxxx....found.io:9200"  
ssl =\> false  
user =\> "logstash"  
password =\> "xxxxx"  
}

Here is what I have for logstash in my shield configuration for this found instance:  
logstash: $2a$12$O4VUZiPILHPgyeL1xcMElOFJuRpxWoXv8Ln1VrpkrtgUoqLz3LY7K

logstash:  
cluster: all  
indices:  
'\*': all

---

<div class="post-metadata">

**Author:** ![geekpete](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geekpete/32/20409_2.png) [@geekpete](https://discuss.elastic.co/u/geekpete)\
**Post date:** [September 23, 2016, 7:29am UTC](https://discuss.elastic.co/t/what-causes-the-403-template-error/34541/2 "2016-09-23T07:29:41Z")

</div>

Be careful that you're mapping roles to users and not users to roles:

```
# This editor maps roles to users of that role, like this:
# role_name: user1, user2

admin: admin
readwrite: readwrite
readonly: readonly

```

the left hand side is the roles and the right hand side are the list of users.

If by accident you mixed these up, eg:

```
admin: admin
readwrite: readwrite
readonly: readonly
mynewuser: myrole

```

Then you'll just get denied without much more info to let you know of your mistake.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:37am UTC](https://discuss.elastic.co/t/what-causes-the-403-template-error/34541/3 "2017-07-06T04:37:13Z")

</div>