Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Metricbeat not able to load dashboards into Kibana #58

Closed
imran-arshad opened this issue Jan 19, 2018 · 9 comments

Comments

Projects
None yet
5 participants
@imran-arshad
Copy link

commented Jan 19, 2018

I have ELK stack deployed on Docker with SearchGuard enabled, and the searchguard-kibana-plugin installed. ElasticSearch has the Searchguard demo roles and users enabled.

I am trying to ship Metricbeat logs to my ELK. I have the following configuration in my metricbeat.yml:

output.elasticsearch:
  hosts: ["localhost:9200"]
  username: "admin"
  password: "admin"

setup.kibana:
  host: "localhost:5601"
  username: "admin"
  password: "admin"

So I am basically using the demo admin user (which has access to all indices. I also tried with the demo kibanaserver user that has access on .kibana index).

The issue is that whenever I run the metricbeat setup step, I get access denied from Kibana. The logs in Metricbeat look like this:

$ ./metricbeat setup

Loaded index template

Exiting: Error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory /Users/test/Code/Elastic/metricbeat-6.1.0-darwin-x86_64/kibana: Failed to import index-pattern: Failed to load directory /Users/test/Code/Elastic/metricbeat-6.1.0-darwin-x86_64/kibana/default/index-pattern:

  error loading /Users/test/Code/Elastic/metricbeat-6.1.0-darwin-x86_64/kibana/default/index-pattern/metricbeat.json: 403 Forbidden. Response: {"statusCode":403,"error":"Forbidden","message":"Error: Unauthorized"}

The logs in Kibana look like this:

{"type":"response","@timestamp":"2018-01-18T22:47:17Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/api/status","method":"get","headers":{"host":"localhost:5601","user-agent":"Go-http-client/1.1","accept":"application/json","content-type":"application/json","accept-encoding":"gzip"},"remoteAddress":"172.18.0.1","userAgent":"172.18.0.1"},"res":{"statusCode":200,"responseTime":39,"contentLength":9},"message":"GET /api/status 200 39ms - 9.0B"}

{"type":"response","@timestamp":"2018-01-18T22:47:17Z","tags":[],"pid":1,"method":"post","statusCode":403,"req":{"url":"/api/kibana/dashboards/import?force=true","method":"post","headers":{"host":"localhost:5601","user-agent":"Go-http-client/1.1","content-length":"250474","accept":"application/json","content-type":"application/json","kbn-version":"6.1.0","accept-encoding":"gzip"},"remoteAddress":"172.18.0.1","userAgent":"172.18.0.1"},"res":{"statusCode":403,"responseTime":13,"contentLength":9},"message":"POST /api/kibana/dashboards/import?force=true 403 13ms - 9.0B"}

When I use Kibana without SG, the dashboards are imported without any error. It seems like SG is blocking those methods on Kibana. I get the same error with Filebeat too

  • Elasticsearch: 6.1.0
  • Kibana: 6.1.0
  • SearchGuard: 6.1.0-20
  • No enterprise modules enabled
@simmonHuong

This comment has been minimized.

Copy link

commented Jan 25, 2018

elasticsearch + filebeat + kibana version : 6.1.1 with the same error
{"statusCode":403,"error":"Forbidden","message":"Error: Unauthorized"}

I deal with this problem with disable searchguard and use a new instance of kibana and filebeat,import dashboard with success.
Then i can enable searchguard.

@floragunncom

This comment has been minimized.

Copy link
Owner

commented Jan 25, 2018

A fix for this is already in the making

floragunncom pushed a commit that referenced this issue Jan 27, 2018

@jochenkressin

This comment has been minimized.

Copy link
Collaborator

commented Feb 1, 2018

Yes, it's a different effect, but the root cause is the same.

@floragunncom

This comment has been minimized.

Copy link
Owner

commented Feb 5, 2018

@jochenkressin

This comment has been minimized.

Copy link
Collaborator

commented Feb 5, 2018

Yes, same one.

@slima

This comment has been minimized.

Copy link

commented Feb 6, 2018

is there any way around?

@jochenkressin

This comment has been minimized.

Copy link
Collaborator

commented Feb 6, 2018

Hang tight, new versions of SG and the Kibana plugin which includes a fix for this issue will be released this week

@jochenkressin

This comment has been minimized.

Copy link
Collaborator

commented Feb 7, 2018

Fixed with v10 of the Kibana plugin, released today.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.