# Winlogbeat dashboard import

**URL:** https://forum.opensearch.org/t/winlogbeat-dashboard-import/2935
**Category:** General Feedback
**Created:** [June 1, 2020, 5:22am UTC](https://forum.opensearch.org/t/winlogbeat-dashboard-import/2935 "2020-06-01T05:22:02Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sera4000](https://avatars.discourse-cdn.com/v4/letter/s/a8b319/32.png) [@sera4000](https://forum.opensearch.org/u/sera4000)
#### Post date: [June 1, 2020, 5:22am UTC](https://forum.opensearch.org/t/winlogbeat-dashboard-import/2935/1 "2020-06-01T05:22:02Z")

</div>

Using latest AWS-managed ES (ver 7.4.2), and Winlogbeat OSS 7.4.2 on Win10, I am unable to import the pre-built dashboards. Other than that, winlogbeat is uploading logs into ES fine. The index template was created successfully, but the dashboard import failed.

Powershell command run:

.\winlogbeat.exe setup -dashboards

Result:

Index setup finished.  
Loading dashboards (Kibana must be running and reachable)  
Exiting: Failed to import dashboard: Failed to load directory C:\Program Files\winlogbeat\kibana/7/dashboard: error loading C:\Program Files\winlogbeat\kibana\7\dashboard\Winlogbeat-overview.json: returned 401 to import file: . Response: {“message”:“Session expired”,“redirectTo”:“login”}

(I’m using the credentials of local db “master user”.)

Trying to import the dashboard via the UI also fails, with this error:

Sorry, there was an error. Saved objects file format is invalid and cannot be imported.

Any help much appreciated.

Sera

---

<div class="post-metadata">

### Author: ![sera4000](https://avatars.discourse-cdn.com/v4/letter/s/a8b319/32.png) [@sera4000](https://forum.opensearch.org/u/sera4000)
#### Post date: [June 1, 2020, 7:49am UTC](https://forum.opensearch.org/t/winlogbeat-dashboard-import/2935/2 "2020-06-01T07:49:42Z")

</div>

I think this is getting blocked by fine-grained access control (FGAC). I created an identical ES domain, but with FGAC disabled. I was then able to import the dashboards via the beat agent. Any suggestions for configuring FGAC to allow this?

---

<div class="post-metadata">

### Author: ![chrisw](https://avatars.discourse-cdn.com/v4/letter/c/919ad9/32.png) [@chrisw](https://forum.opensearch.org/u/chrisw)
#### Post date: [January 12, 2021, 11:56am UTC](https://forum.opensearch.org/t/winlogbeat-dashboard-import/2935/3 "2021-01-12T11:56:01Z")

</div>

@sera4000 - Did you ever resolve this?

I think I have hit the same issue - I can’t upload the winlogbeat dashboards, and also have FGAC enabled