Winlogbeat dashboard import

General Feedback
1

Using latest AWS-managed ES (ver 7.4.2), and Winlogbeat OSS 7.4.2 on Win10, I am unable to import the pre-built dashboards. Other than that, winlogbeat is uploading logs into ES fine. The index template was created successfully, but the dashboard import failed.

Powershell command run:

.\winlogbeat.exe setup -dashboards

Result:

Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Exiting: Failed to import dashboard: Failed to load directory C:\Program Files\winlogbeat\kibana/7/dashboard: error loading C:\Program Files\winlogbeat\kibana\7\dashboard\Winlogbeat-overview.json: returned 401 to import file: . Response: {“message”:“Session expired”,“redirectTo”:“login”}

(I’m using the credentials of local db “master user”.)

Trying to import the dashboard via the UI also fails, with this error:

Sorry, there was an error. Saved objects file format is invalid and cannot be imported.

Any help much appreciated.

Sera

2

I think this is getting blocked by fine-grained access control (FGAC). I created an identical ES domain, but with FGAC disabled. I was then able to import the dashboards via the beat agent. Any suggestions for configuring FGAC to allow this?

3

@sera4000 - Did you ever resolve this?

I think I have hit the same issue - I can’t upload the winlogbeat dashboards, and also have FGAC enabled