We have seen several reports where Elastic Agent tried to ingest data into a metricbeat-* index but did not have permissions. It turned out that for some reason on Windows the system.yml file in the modules.d directory is not renamed to system.yml.disabled which causes this. The workaround for now is to rename the file manually.

We need to investigate why this happens in the first place.

Links

• Discuss topic