# Unable to save watches

**URL:** <https://forum.search-guard.com/t/unable-to-save-watches/2104>\
**Category:** Search Guard\
**Created:** [February 23, 2021, 3:16pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104 "2021-02-23T15:16:59Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![lzukel](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lzukel](https://forum.search-guard.com/u/lzukel)\
**Post date:** [February 23, 2021, 3:17pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/1 "2021-02-23T15:17:00Z")

</div>

**Elasticsearch version:**  
7.10.2

**Kibana version (if relevant):**  
7.10.2

**Describe the issue:**  
When creating a watch, I am unable to save the watch.  
Kibana returning:

> {“type”:“response”,“@timestamp”:“2021-02-23T15:11:02Z”,“tags”:,“pid”:16,“method”:“get”,“statusCode”:404,“req”:{“url”:“/api/searchguard-signals/watch/Kibana%20Settings%20Watch”,“method”:“get”,“headers”:{“host”:“edited”,“sec-ch-ua”:“"Chromium";v="88", "Google Chrome";v="88", ";Not A Brand";v="99"”,“sec-ch-ua-mobile”:“?0”,“user-agent”:“Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36”,“kbn-version”:“7.10.2”,“content-type”:“application/json”,“accept”:“_/_”,“sec-fetch-site”:“same-origin”,“sec-fetch-mode”:“cors”,“sec-fetch-dest”:“empty”,“referer”:“[https://edited/kibana/app/searchguard-signals",“accept-encoding”:"gzip](https://edited/kibana/app/searchguard-signals%22,%22accept-encoding%22:%22gzip), deflate, br”,“accept-language”:“en-US,en;q=0.9,fr;q=0.8”,“x-opaque-id”:“mine”,“x-forwarded-for”:“142.136.146.158, 44.128.168.125”,“x-forwarded-host”:“edited”,“x-forwarded-proto”:“https”,“connection”:“close”},“remoteAddress”:“44.128.168.1”,“userAgent”:“Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36”,“referer”:“[https://edited/kibana/app/searchguard-signals"},“res”:{“statusCode”:404,“responseTime”:98,“contentLength”:9},“message”:"GET](https://edited/kibana/app/searchguard-signals%22%7D,%22res%22:%7B%22statusCode%22:404,%22responseTime%22:98,%22contentLength%22:9%7D,%22message%22:%22GET) /api/searchguard-signals/watch/Kibana%20Settings%20Watch 404 98ms - 9.0B”}

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [February 23, 2021, 3:48pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/2 "2021-02-23T15:48:16Z")

</div>

Do you see any error in the Elasticsearch log? What do you see in UI when you try to save the watch, any error? What do you see in the browser console log (enable the debug mode)?

---

<div class="post-metadata">

**Author:** ![lzukel](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lzukel](https://forum.search-guard.com/u/lzukel)\
**Post date:** [February 23, 2021, 4:10pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/3 "2021-02-23T16:10:15Z")

</div>

Browser console

```
Failed to load resource: the server responded with a status of 404 (Not Found)

```

Nothing that appears relevant in the Elasticsearch logs  
The UI does not change when trying to save the watch

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [February 23, 2021, 5:20pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/4 "2021-02-23T17:20:05Z")

</div>

Hm. I can’t reproduce it. Do you use Search Guard v49.0.0?  
Maybe it is the watch name encoding issue. Try to save a watch with name Kibana\_Settings\_Watch.

---

<div class="post-metadata">

**Author:** ![lzukel](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lzukel](https://forum.search-guard.com/u/lzukel)\
**Post date:** [February 23, 2021, 5:34pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/5 "2021-02-23T17:34:24Z")

</div>

```
search-guard-7	7.10.2-49.0.0

```

Updated the title to use underscores instead of spaces… Still get 404 in kibana logs

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [February 23, 2021, 6:54pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/6 "2021-02-23T18:54:15Z")

</div>

Get the watch for me via the REST API.

```auto
curl -k -u admin:admin -X GET https://localhost:9200/_signals/watch/tenant_name/Kibana%20Settings%20Watch

```

Use your own credentials instead of `admin:admin`. Also, you need to specify your tenant name instead of `tenant_name`. If you have the Multitenancy disabled, use `_main`.

Also, paste the kibana.yml.

---

<div class="post-metadata">

**Author:** ![lzukel](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lzukel](https://forum.search-guard.com/u/lzukel)\
**Post date:** [February 23, 2021, 6:58pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/7 "2021-02-23T18:58:08Z")

</div>

How to use own credentials, when users are required to use SSO via keycloak?

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [February 23, 2021, 7:00pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/8 "2021-02-23T19:00:14Z")

</div>

I think you still have the admin. Because you need it to update the Search Guard config. Try admin.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [February 23, 2021, 7:51pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/9 "2021-02-23T19:51:12Z")

</div>

Can you tell me on which step the error arise? For example

1. Click Create Watch
2. Put values. What values?
3. Click Save
4. ERROR

Can you attach the screenshot?

---

<div class="post-metadata">

**Author:** ![lzukel](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lzukel](https://forum.search-guard.com/u/lzukel)\
**Post date:** [February 23, 2021, 8:07pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/10 "2021-02-23T20:07:04Z")

</div>

curl -k -u admin:password -X GET [https://host:9200/\_signals/watch/\_main/Kibana%20Settings%20Watch](https://host:9200/_signals/watch/_main/Kibana%20Settings%20Watch)  
{  
“status” : 403,  
“error” : “no permissions for [cluster:admin:searchguard:tenant:signals:watch/get] and User [name=admin, backend\_roles=, requestedTenant=null]”  
}

This error does not show in kibana logs when I try to save in UI

---

<div class="post-metadata">

**Author:** ![lzukel](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lzukel](https://forum.search-guard.com/u/lzukel)\
**Post date:** [February 23, 2021, 8:07pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/11 "2021-02-23T20:07:33Z")

</div>

No error in kibana UI when trying to save the watch

---

<div class="post-metadata">

**Author:** ![lzukel](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lzukel](https://forum.search-guard.com/u/lzukel)\
**Post date:** [February 23, 2021, 9:33pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/12 "2021-02-23T21:33:10Z")

</div>

I added the admin user to the role that should be able to manage signals/watches…

> sg\_signals\_manager:  
> reserved: false  
> hidden: false  
> backend\_roles:
> 
> - “kibana-watches-users”  
> users:
> - “admin”  
> description: “Keycloak group that allows users access to watches in kibana”

added the missing permissions to that role…

> sg\_signals\_manager:  
> reserved: false  
> hidden: false  
> description: “Role for kibana users to be able to use watches”  
> cluster\_permissions:
> 
> - “SGS\_SIGNALS\_ACCOUNT\_MANAGE”
> - “SGS\_CLUSTER\_COMPOSITE”
> - “SGS\_SIGNALS\_ALL”
> - “admin:searchguard:tenant:signals:watch/\*”  
> index\_permissions:
> - index\_patterns:
> - “?kibana-\*”  
> dls: null  
> fls: null  
> masked\_fields: null  
> allowed\_actions:
> - “READ”
> 
> - index\_patterns:
> - “\*”  
> dls: null  
> fls: null  
> masked\_fields: null  
> allowed\_actions:
> - “indices:data/read/field\_caps\*”
> - “indices:data/read/search”  
> tenant\_permissions:
> 
> - tenant\_patterns:
> - “SGS\_GLOBAL\_TENANT”  
> allowed\_actions:
> - “SGS\_SIGNALS\_ALL”

Now when I run the curl command provided earlier:

> curl -k -u admin:pasword -X GET [https://host:9200/\_signals/watch/\_main/Kibana\_Settings\_Watch](https://host:9200/_signals/watch/_main/Kibana_Settings_Watch)  
> {  
> “status” : 404,  
> “error” : “Not found”  
> }

Still unable to save the watch in Kibana

---

<div class="post-metadata">

**Author:** ![lzukel](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lzukel](https://forum.search-guard.com/u/lzukel)\
**Post date:** [February 23, 2021, 10:48pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/13 "2021-02-23T22:48:50Z")

</div>

occasionallyI get the following error (even when trying to add sample signal):

```auto
{
  "statusCode": 500,
  "error": "Internal Server Error",
  "message": "Response Error",
  "attributes": {
    "body": {
      "status": 500,
      "error": "AuthTokenProvider is not configured"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [February 24, 2021, 1:35pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/14 "2021-02-24T13:35:30Z")

</div>

The authtoken error is not related.  
By doing `-X GET` you get the watch, not create it. The API response says there is no watch with name Kibana\_Settings\_Watch in the \_main context.

Put a watch, for example

```auto
curl -k -u admin:admin -X PUT https://localhost:9200/_signals/watch/_main/a%20watch -H 'Content-Type: application/json' -d'
{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "checks": [
    {
      "type": "search",
      "request": {
        "indices": ["*"],
        "body": {
          "query": {
            "match_all": {}
          }
        }
      }
    }
  ],
  "actions": []
}'

```

Now get it

```auto
curl -k -u admin:admin -X GET https://localhost:9200/_signals/watch/_main/a%20watch?pretty

```

Does it work for you?

---

<div class="post-metadata">

**Author:** ![lzukel](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lzukel](https://forum.search-guard.com/u/lzukel)\
**Post date:** [February 24, 2021, 1:44pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/15 "2021-02-24T13:44:42Z")

</div>

First curl does not return anything. No watch was created.  
Second curl does not return anything. See: No watch was created

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [February 24, 2021, 1:47pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/16 "2021-02-24T13:47:48Z")

</div>

> First curl does not return anything. No watch was created.

Do you see any error in the Elasticsearch or Kibana?

> [@lzukel](#):
>
> No error in kibana UI when trying to save the watch

Let’s troubleshoot it in UI too.

Do you see any related error in the dev console log of your browser? Enable the verbose mode and show me all the messages in the console log.

 ![Screenshot 2021-02-24 at 14.39.56](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/c4cd2bbd26924ab72e6fcaca85a1f79f698f8c59.jpeg)

Also show me the network calls.

 ![Screenshot 2021-02-24 at 14.43.04](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/075de4fca26764fd6966d037b98f28b1785b3721.png)

Copy for me the request headers and responses for each failed call.

 ![Screenshot 2021-02-24 at 14.44.36](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/56bef3d99e20ec67a218a36033afc4d684cb72eb.jpeg) ![Screenshot 2021-02-24 at 14.44.41](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/87f6c42398caafa73c5b0f5ec04a39aa99f2b4d7.png)

---

<div class="post-metadata">

**Author:** ![lzukel](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lzukel](https://forum.search-guard.com/u/lzukel)\
**Post date:** [February 24, 2021, 1:55pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/17 "2021-02-24T13:55:45Z")

</div>

![image](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/16bc144e14790e36671a1f5ab7a9a721d22e55eb.jpeg)  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/4ebf1f7d1c8e2c971676d954467e9b11eb45832c.png)  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/2d30872472764d465522c9fffe989b2d0a433c56.png)

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [February 24, 2021, 2:02pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/18 "2021-02-24T14:02:59Z")

</div>

After what action do you see the Internal Server Error toast? After you clicked an add button on the Watch Examples flyout?

---

<div class="post-metadata">

**Author:** ![lzukel](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lzukel](https://forum.search-guard.com/u/lzukel)\
**Post date:** [February 24, 2021, 2:03pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/19 "2021-02-24T14:03:51Z")

</div>

Anytime when trying to add/create watch

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [February 24, 2021, 2:05pm UTC](https://forum.search-guard.com/t/unable-to-save-watches/2104/20 "2021-02-24T14:05:19Z")

</div>

Weird. I have never seen this. Can you send your sg\_config.yml and kibana.yml? **Don’t forget to obfuscate the credentials.**

[Next page](https://forum.search-guard.com/t/unable-to-save-watches/2104.md?page=2)