🚨 Filebeat Error Guide: 'error loading index pattern' — Fix Kibana Setup

Overview

filebeat setup loads the index pattern, dashboards, and other Kibana assets. When Filebeat cannot reach or authenticate to Kibana, it aborts and logs:

Exiting: error loading index pattern: error loading index pattern: returned 401 to import file: <nil>. Response: {"statusCode":401,"error":"Unauthorized","message":"[security_exception] missing authentication credentials"}

The index pattern is a Kibana object, so unlike template/ILM setup (which talks to Elasticsearch), this call goes to the Kibana endpoint configured under setup.kibana. A missing setup.kibana.host, wrong credentials, an unreachable Kibana, or a version mismatch all surface here. Because setup treats loading Kibana assets as a hard step, Filebeat exits rather than continuing — which is why this error is common the first time filebeat setup runs against a secured stack.

Symptoms

• Exiting: error loading index pattern (often with 401, connection refused, or a version error) during filebeat setup.
• Kibana has no filebeat-* index pattern and no Filebeat dashboards.
• The error names Kibana, not Elasticsearch, in the endpoint or response body.
• Ingestion may still work (data flows to Elasticsearch) but visualization assets are missing.
• Errors start after enabling security or moving Kibana behind a new URL/proxy.

Common Root Causes

• setup.kibana unset or wrong — Filebeat defaults to localhost:5601, which is wrong for remote Kibana.
• Missing/invalid credentials — Kibana needs setup.kibana.username/password (or the output creds) with setup privileges.
• Kibana unreachable — Kibana is down, behind a proxy path, or on a non-default port.
• Version mismatch — Filebeat and Kibana major/minor versions differ enough that asset import is rejected.
• Base path / space — a Kibana server.basePath or non-default space is not reflected in setup.kibana.path.
• TLS to Kibana — https Kibana without the CA configured under setup.kibana.ssl.

Diagnostic Workflow

Run setup verbosely so the Kibana endpoint and status code are explicit:

filebeat setup --dashboards -e -v 2>&1 | tail -30
grep -A6 'setup.kibana' /etc/filebeat/filebeat.yml

Confirm Kibana is reachable and which version it is from the Filebeat host:

curl -sk https://kibana01:5601/api/status -u elastic:$ES_PASS | jq '.version.number, .status.overall'

Test the Kibana authentication Filebeat will use:

curl -sk -o /dev/null -w '%{http_code}\n' \
  https://kibana01:5601/api/saved_objects/_find?type=index-pattern \
  -u elastic:$ES_PASS -H 'kbn-xsrf: true'

If Kibana uses a base path, verify it:

curl -skL https://kibana01:5601/ -o /dev/null -w '%{url_effective}\n'

Example Root Cause Analysis

A new Filebeat rollout ran filebeat setup against a secured cluster and died with error loading index pattern ... 401 Unauthorized. Index-management setup (template/ILM) had succeeded because those creds went to Elasticsearch, but setup.kibana had no credentials, so the Kibana asset import was anonymous and rejected.

The reproduction curl to /api/saved_objects/_find with -u elastic:$ES_PASS returned 200, proving the credentials were valid — they just were not configured for Kibana. Adding them fixed setup:

setup.kibana:
  host: "https://kibana01:5601"
  username: "elastic"
  password: "${ES_PASS}"
  ssl.certificate_authorities: ["/etc/filebeat/certs/ca.crt"]

Re-running filebeat setup --dashboards imported the index pattern and dashboards with a Loaded dashboards confirmation. The team then removed the Kibana block from the steady-state config since assets only need loading once.

Prevention Best Practices

• Set setup.kibana.host (and credentials/CA) explicitly — never rely on the localhost:5601 default for remote Kibana.
• Run filebeat setup once from a host that can reach Kibana, with a user holding Kibana setup privileges.
• Keep Filebeat and Kibana on matching versions so saved-object import is accepted.
• Account for server.basePath and Kibana spaces in setup.kibana.path when Kibana is proxied.
• Separate one-time setup from steady-state ingestion so runtime agents do not carry Kibana credentials.

Quick Command Reference

filebeat setup --dashboards -e -v
curl -sk https://kibana01:5601/api/status -u elastic:$ES_PASS | jq '.version.number, .status.overall'
curl -sk -o /dev/null -w '%{http_code}\n' 'https://kibana01:5601/api/saved_objects/_find?type=index-pattern' -u elastic:$ES_PASS -H 'kbn-xsrf: true'
grep -A6 setup.kibana /etc/filebeat/filebeat.yml

Conclusion

error loading index pattern is a Kibana-side setup failure, not an Elasticsearch output problem: the setup.kibana host, credentials, TLS, or version is wrong. Read the endpoint and status in the verbose log, reproduce the Kibana call with curl, and set setup.kibana correctly. Load the assets once and steady-state Filebeat needs no Kibana credentials at all. More setup fixes are in the Filebeat guides.