# Winlogbeat not getting updated in Kibana

**URL:** <https://discuss.elastic.co/t/winlogbeat-not-getting-updated-in-kibana/207797>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [November 14, 2019, 1:43am UTC](https://discuss.elastic.co/t/winlogbeat-not-getting-updated-in-kibana/207797 "2019-11-14T01:43:06Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bharat05](https://avatars.discourse-cdn.com/v4/letter/b/f17d59/32.png) [@Bharat05](https://discuss.elastic.co/u/Bharat05)\
**Post date:** [November 14, 2019, 1:43am UTC](https://discuss.elastic.co/t/winlogbeat-not-getting-updated-in-kibana/207797/1 "2019-11-14T01:43:07Z")

</div>

I am doing a POC in Elastic Stack using version 6.5.2. I am facing an issue in Kibana as the data are not getting updated. The winlogbeat indices creation stopped after a October 23 and no new indices have been created after that.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f7c7cb270c7e135aaf9283fe8bbca4ffcfb0a424.png)

Can someone tell me what might be the reason for this?? Please let me know for any more information.

Thanks for you help in advance.

---

<div class="post-metadata">

**Author:** ![Bharat05](https://avatars.discourse-cdn.com/v4/letter/b/f17d59/32.png) [@Bharat05](https://discuss.elastic.co/u/Bharat05)\
**Post date:** [November 14, 2019, 2:24am UTC](https://discuss.elastic.co/t/winlogbeat-not-getting-updated-in-kibana/207797/2 "2019-11-14T02:24:48Z")

</div>

Hi,  
Please find below a snapshot of the Kibana.stdout log.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed38f90ab6928b6771c39820fbf835d27e61d0a3.png)

Please help.

Thanks,  
Bharat

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [November 15, 2019, 10:15am UTC](https://discuss.elastic.co/t/winlogbeat-not-getting-updated-in-kibana/207797/3 "2019-11-15T10:15:11Z")

</div>

Hi @Bharat05,

Do you check your Winlogbeat logs?

Best regards

---

<div class="post-metadata">

**Author:** ![Bharat05](https://avatars.discourse-cdn.com/v4/letter/b/f17d59/32.png) [@Bharat05](https://discuss.elastic.co/u/Bharat05)\
**Post date:** [November 18, 2019, 5:48am UTC](https://discuss.elastic.co/t/winlogbeat-not-getting-updated-in-kibana/207797/4 "2019-11-18T05:48:11Z")

</div>

Hi @exekias,  
Thanks for your reply.  
Sorry for the late reply but I am not able to find the Winlogbeat logs . Could you please tell me where to find the it as Winlogbeat is installed in the Server.

Also wanted to inform that metric beat is also installed and it is working correctly as it is collecting data from November month but not winlogbeat. I am not able to get what might have caused this issue.

Best Regards,  
Bharat

---

<div class="post-metadata">

**Author:** ![Bharat05](https://avatars.discourse-cdn.com/v4/letter/b/f17d59/32.png) [@Bharat05](https://discuss.elastic.co/u/Bharat05)\
**Post date:** [November 20, 2019, 4:27am UTC](https://discuss.elastic.co/t/winlogbeat-not-getting-updated-in-kibana/207797/5 "2019-11-20T04:27:51Z")

</div>

Hi @exekias,  
Please find below a snapshot of logstash logs:  
Logstash:  
({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
[2019-11-20T02:47:28,556][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
[2019-11-20T02:47:28,556][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
[2019-11-20T02:47:28,556][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
[2019-11-20T02:47:28,556][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
[2019-11-20T02:47:28,557][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
[2019-11-20T02:47:28,557][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
[2019-11-20T02:47:28,557][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
[2019-11-20T02:47:28,557][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
[2019-11-20T02:47:28,560][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
[2019-11-20T02:47:28,561][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
[2019-11-20T02:47:28,561][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=\>11}  
[2019-11-20T02:48:20,869][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})

---

<div class="post-metadata">

**Author:** ![Bharat05](https://avatars.discourse-cdn.com/v4/letter/b/f17d59/32.png) [@Bharat05](https://discuss.elastic.co/u/Bharat05)\
**Post date:** [November 20, 2019, 4:52am UTC](https://discuss.elastic.co/t/winlogbeat-not-getting-updated-in-kibana/207797/6 "2019-11-20T04:52:22Z")

</div>

This is my elasticsearch log:  
[2019-11-07T15:06:51,351][WARN][o.e.x.m.e.l.LocalExporter] [MU6Axku] unexpected error while indexing monitoring document  
org.elasticsearch.xpack.monitoring.exporter.ExportException: ClusterBlockException[blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];]  
at org.elasticsearch.xpack.monitoring.exporter.local.LocalBulk.lambda$throwExportException$2(LocalBulk.java:128) ~[?:?]  
at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193) ~[?:1.8.0\_191]  
at java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:175) ~[?:1.8.0\_191]  
at java.util.Spliterators$ArraySpliterator.forEachRemaining(Spliterators.java:948) ~[?:1.8.0\_191]  
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481) ~[?:1.8.0\_191]  
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471) ~[?:1.8.0\_191]  
at java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:151) ~[?:1.8.0\_191]  
at java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:174) ~[?:1.8.0\_191]  
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0\_191]  
at java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:418) ~[?:1.8.0\_191]  
at org.elasticsearch.xpack.monitoring.exporter.local.LocalBulk.throwExportException(LocalBulk.java:129) ~[?:?]  
at org.elasticsearch.xpack.monitoring.exporter.local.LocalBulk.lambda$doFlush$0(LocalBulk.java:111) ~[?:?]  
at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:60) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.ContextPreservingActionListener.onResponse(ContextPreservingActionListener.java:43) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.TransportAction$1.onResponse(TransportAction.java:85) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.TransportAction$1.onResponse(TransportAction.java:81) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.bulk.TransportBulkAction$BulkRequestModifier.lambda$wrapActionListenerIfNeeded$0(TransportBulkAction.java:607) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:60) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.bulk.TransportBulkAction$BulkOperation$1.finishHim(TransportBulkAction.java:414) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.bulk.TransportBulkAction$BulkOperation$1.onFailure(TransportBulkAction.java:409) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.TransportAction$1.onFailure(TransportAction.java:91) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.finishAsFailed(TransportReplicationAction.java:901) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.handleBlockException(TransportReplicationAction.java:824) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.handleBlockExceptions(TransportReplicationAction.java:812) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.doRun(TransportReplicationAction.java:710) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.replication.TransportReplicationAction.doExecute(TransportReplicationAction.java:169) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.replication.TransportReplicationAction.doExecute(TransportReplicationAction.java:97) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:167) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.apply(SecurityActionFilter.java:126) ~[?:?]  
at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:139) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:81) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.bulk.TransportBulkAction$BulkOperation.doRun(TransportBulkAction.java:384) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.bulk.TransportBulkAction.executeBulk(TransportBulkAction.java:496) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.bulk.TransportBulkAction.executeIngestAndBulk(TransportBulkAction.java:243) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.bulk.TransportBulkAction.doExecute(TransportBulkAction.java:169) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.bulk.TransportBulkAction.lambda$processBulkIndexIngestRequest$4(TransportBulkAction.java:549) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.ingest.IngestService$4.doRun(IngestService.java:417) [elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:723) [elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.5.2.jar:6.5.2]  
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0\_191]  
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0\_191]  
at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_191]  
Caused by: org.elasticsearch.cluster.block.ClusterBlockException: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];  
at org.elasticsearch.cluster.block.ClusterBlocks.indexBlockedException(ClusterBlocks.java:183) ~[elasticsearch-6.5.2.jar:6.5.2]  
at org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.handleBlockExceptions(TransportReplicationAction.java:810) ~[elasticsearch-6.5.2.jar:6.5.2]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 18, 2019, 4:52am UTC](https://discuss.elastic.co/t/winlogbeat-not-getting-updated-in-kibana/207797/7 "2019-12-18T04:52:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.