Grafana with elasticsearch explore not working

I am trying to use elasticsearch plugin in Grafana (v10.4.2) but It is not working.

I have successfully created a data source and connections are validated but when I am trying to explore the data it is giving 403 error. I am not able to find proper error messages in the logs as well.

4-29T15:13:54.520061446-07:00 level=debug msg="Creating new client" configuredFields="es.ConfiguredFields{TimeField:\"@timestamp\", LogMessageField:\"message\", LogLevelField:\"\"}" indices=ds-stage-pgleo-* interval= index=ds-stage-pgleo-*
Apr 29 15:13:54 rno-ds-monitor-1 grafana: logger=tsdb.elasticsearch endpoint=queryData pluginId=elasticsearch dsName=elasticsearch dsUID=cdk80szarjncwf uname=admin fromAlert=false t=2024-04-29T15:13:54.520103043-07:00 level=debug msg="Parsing queries" queriesLength=1
Apr 29 15:13:54 rno-ds-monitor-1 grafana: logger=tsdb.elasticsearch endpoint=queryData pluginId=elasticsearch dsName=elasticsearch dsUID=cdk80szarjncwf uname=admin fromAlert=false t=2024-04-29T15:13:54.520173214-07:00 level=info msg="Prepared request" queriesLength=1 duration=70.418µs stage=prepareRequest
Apr 29 15:13:54 rno-ds-monitor-1 grafana: logger=tsdb.elasticsearch endpoint=queryData pluginId=elasticsearch dsName=elasticsearch dsUID=cdk80szarjncwf uname=admin fromAlert=false entity=client t=2024-04-29T15:13:54.520328682-07:00 level=debug msg="Completed encoding of batch requests to json" duration=130.683µs
Apr 29 15:13:54 rno-ds-monitor-1 grafana: logger=tsdb.elasticsearch endpoint=queryData pluginId=elasticsearch dsName=elasticsearch dsUID=cdk80szarjncwf uname=admin fromAlert=false entity=client t=2024-04-29T15:13:54.520351776-07:00 level=debug msg="Sending request to Elasticsearch" url=https://localhost:9200
Apr 29 15:13:54 rno-ds-monitor-1 grafana: logger=tsdb.elasticsearch endpoint=queryData pluginId=elasticsearch dsName=elasticsearch dsUID=cdk80szarjncwf uname=admin fromAlert=false entity=client t=2024-04-29T15:13:54.530715604-07:00 level=error msg="Error received from Elasticsearch" error="Post \"https://localhost:9200/_msearch?max_concurrent_shard_requests=5\": 403 Forbidden" status=error duration=10.513395ms stage=databaseRequest statusSource=downstream

looks like a 403 forbidden

How do we fix this? When I make a curl call it is working. There is no connectivity issue.

It was a permission issue. I have added right permissions. Now it is working.

1 Like