You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description:
Following the guide Collect Logstash monitoring data for stack monitoring it's requested to create a user with role remote_monitoring_collector , but that's not enough. With just that role, the ElasticAgent logs the following erro message:
{
"log.level":"error",
"@timestamp":"2024-05-03T08:44:22.747Z",
"message":"failed to perform any bulk index operations: 403 Forbidden: {\"error\":{\"root_cause\":[{\"type\":\"security_exception\",\"reason\":\"action [indices:data/write/bulk] is unauthorized for user [logstash_collector] with effective roles [remote_monitoring_collector] (assigned roles [create,create_doc,delete,index,write] were not found), this action is granted by the index privileges [create_doc,create,delete,index,write,all]\"}],\"type\":\"security_exception\",\"reason\":\"action [indices:data/write/bulk] is unauthorized for user [logstash_collector] with effective roles [remote_monitoring_collector] (assigned roles [create,create_doc,delete,index,write] were not found), this action is granted by the index privileges [create_doc,create,delete,index,write,all]\"},\"status\":403}",
"component":
{"binary":"filebeat",
"dataset":"elastic_agent.filebeat",
"id":"log-default",
"type":"log"},
"log":
{"source":"log-default"},
"log.logger":"elasticsearch",
"log.origin":
{"file.line":258,
"file.name":"elasticsearch/client.go"},
"service.name":"filebeat",
"ecs.version":"1.6.0",
"ecs.version":"1.6.0"
}
but roles named create,create_doc,delete,index,write cited in (assigned roles [create,create_doc,delete,index,write] were not found), doesn't exists, are just privileges.
Adding also the role remote_monitor_agent fixes the problem
Tell us about the issue
Description:
Following the guide
Collect Logstash monitoring data for stack monitoring
it's requested to create a user with roleremote_monitoring_collector
, but that's not enough. With just that role, the ElasticAgent logs the following erro message:but roles named
create,create_doc,delete,index,write
cited in(assigned roles [create,create_doc,delete,index,write] were not found),
doesn't exists, are just privileges.Adding also the role
remote_monitor_agent
fixes the problemURL:
https://www.elastic.co/guide/en/logstash/current/monitoring-with-elastic-agent.html
Anything else?
The text was updated successfully, but these errors were encountered: