Hello Team,
I got stuck at the initial stage itself. I want to first ship local metricbeat data and view them in Kibana locally. The index is not getting created. My default security settings is enabled which comes with default versions. Can anyone help here?
Opendistro version - 1.4.0
Metricbeat verison - 7.4.2
below is my metricbeat.yml file
setup.dashboards.enabled: true
setup.dashboards.index: "metricbeat-%{[agent.version]}-system-%{+yyyy.MM.dd}"
setup.kibana:
host: "testserver1:5601"
output.elasticsearch:
hosts: ["testserver1:9200"]
protocol: "http"
username: "user1****"
password: "****"
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
logging.level: debug
logging.selectors: ["*"]
[root@testserver1 modules.d]# curl -XGET "https://testserver1:9200/_cat/indices?v" -u ********:**** --insecure
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open .kibana_-8795104_metricbeatuser1 eJcVVeVoSeWGNad8AkkJ0w 1 1 624 145 639.2kb 639.2kb
yellow open .kibana_92668751_admin WKkYKZBCSaa6o2pd-aJgsg 1 1 626 650 920.1kb 920.1kb
yellow open security-auditlog-2020.03.21 nq8tDoFIQjuqYJfewi-MAQ 1 1 561 0 251.7kb 251.7kb
green open .opendistro_security u2XYwfV7QHybGkQMR7bzoQ 1 0 6 0 37.4kb 37.4kb
green open .kibana_1 EXpCNyPmTpqFfIdQHMahlg 1 0 3 1 12.2kb 12.2kb
permission error:
[root@testserver1 ]# curl -XGET "https://testserver1:9200/_cat/indices?v" -u user1:***** --insecure
{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [indices:monitor/settings/get] and User [name=user1, backend_roles=[crud, create_index], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [indices:monitor/settings/get] and User [name=user1, backend_roles=[crud, create_index], requestedTenant=null]"},"status":403}[root@testserver1 ]#
So my cluster level permission contains CLUSTER_MONITOR, write, INDICES_ALL and index level permission contains CRUD, CREATE_INDEX, indices_all, indices:admin/template/get and *indices:admin/template/put