# Can not setup beat templates on elasticsearch nodes **URL:** \ **Category:** Beats\ **Tags:** elastic-stack-security, metricbeat\ **Created:** [November 8, 2018, 5:44pm UTC](https://discuss.elastic.co/t/can-not-setup-beat-templates-on-elasticsearch-nodes/155943 "2018-11-08T17:44:34Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![lcui\_dxc](https://avatars.discourse-cdn.com/v4/letter/l/8edcca/32.png) [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Post date:** [November 8, 2018, 5:44pm UTC](https://discuss.elastic.co/t/can-not-setup-beat-templates-on-elasticsearch-nodes/155943/1 "2018-11-08T17:44:34Z")
Hello there, I need to setup the index templates on metribeats (actually all beats, metricbeat is the first one). I got the following: [root@beatshost user1]# /usr/share/metricbeat/bin/metricbeat setup --template --c '/etc/metricbeat/metricbeat.yml' -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["[https://elasticnode01:9200](https://elasticnode01:9200)"]' Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch [https://elasticnode01.hls.dxc.com:9200](https://elasticnode01.hls.dxc.com:9200): 401 Unauthorized: {"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":["Basic realm="security" charset="UTF-8"","Bearer realm="security""]}}],"type":"security\_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":["Basic realm="security" charset="UTF-8"","Bearer realm="security""]}},"status":401}] [root@beatshost user1]# curl -XGET -u elastic:changeme [https://elasticnode01.hls.dxc.com:9200](https://elasticnode01.hls.dxc.com:9200) { "name" : "elasticnode01", "cluster\_name" : "myELK", "cluster\_uuid" : "EXvnfefiQN6vU24CkmTJNw", "version" : { "number" : "6.4.2", "build\_flavor" : "default", "build\_type" : "rpm", "build\_hash" : "04711c2", "build\_date" : "2018-09-26T13:34:09.098244Z", "build\_snapshot" : false, "lucene\_version" : "7.4.0", "minimum\_wire\_compatibility\_version" : "5.6.0", "minimum\_index\_compatibility\_version" : "5.0.0" }, "tagline" : "You Know, for Search" } [root@beatshost user1]# /usr/share/metricbeat/bin/metricbeat setup --template --c '/etc/metricbeat/metricbeat.yml' -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["[https://elasticnode01:9200](https://elasticnode01:9200)"]' Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch [https://elasticnode01:9200](https://elasticnode01:9200): 401 Unauthorized: {"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":["Basic realm="security" charset="UTF-8"","Bearer realm="security""]}}],"type":"security\_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":["Basic realm="security" charset="UTF-8"","Bearer realm="security""]}},"status":401}] Tried use IP address instead of hostname... [root@beatsnode user1]# /usr/share/metricbeat/bin/metricbeat setup --template --c '/etc/metricbeat/metricbeat.yml' -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["[https://elasticnode1-IP:9200](https://elasticnode1-IP:9200)"]' Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch [https://elasticnode1-IP:9200](https://elasticnode1-IP:9200): Get [https://elasticnode1-IP:9200](https://elasticnode1-IP:9200): dial tcp elasticnode1-IP:9200: connect: connection refused] Here is the mertricbeat.yml: ///////////// ... setup.kibana: host: "[https://kibanahost:5601](https://kibanahost:5601)" username: elastic password: changeme ... output.logstash: hosts: ["logstashnodehost:5044"] ssl.certificate\_authorities: ["/opt/keys/my\_g2.crt","/opt/keys/my\_rootca1.crt"] ssl.certificate: "/opt/keys/SvrCertificate.crt" ssl.key: "/opt/keys/xxx-201710-yyy-key.pem" ///////////////////////// This is the beat pipeline config file on Logstash: input { beats { port =\> 5044 client\_inactivity\_timeout =\> 120 ssl =\> true ssl\_certificate\_authorities =\> ["/opt/keys/my\_g2.crt","/opt/keys/my\_rootca1.crt"] ssl\_certificate =\> "/opt/keys/SvrCertificate.crt" ssl\_key =\> "/opt/keys/xxx-201710-yyy-pkcs8.pem" ssl\_verify\_mode =\> "peer" #ssl =\> false } } output { elasticsearch { user =\> "logstash\_ingest" password =\> "mypass" ssl =\> true ssl\_certificate\_verification =\> true cacert =\> "/opt/keys/myBundle2.crt" action =\> "index" hosts =\> ["elasticserchnode1"] manage\_template =\> false index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" document\_type =\> "%{[@metadata][type]}" } } ============================ All beats work fine and they are sending data to Elasticsearch via logstash. We have x-pack installed and SSL enabled on all beats servers and ELK nodes. After upgrade from 6.3.2 to 6.4.2, some errors occurred on indexes and we were suggested to reset up index templates... and now. when trying to setup index templates (metricbeat is the first), we hit this error and can not move forward... I tried on packetbeat to setup index templates, same error. Not sure what we should do to overcome this... Please help.. Thanks Li ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 9, 2018, 4:30am UTC](https://discuss.elastic.co/t/can-not-setup-beat-templates-on-elasticsearch-nodes/155943/2 "2018-11-09T04:30:51Z")
This is really a beats question, so I moved your post there. This error message explains the problem: ```auto Couldn't connect to any of the configured Elasticsearch hosts. Errors: [ Error connection to Elasticsearch https://elasticnode01:9200: 401 Unauthorized: {"error":{ "root_cause":[{"type":"security_exception", "reason":"missing authentication token for REST request [/]", ``` Your elasticsearch cluster has security enabled and you haven't configured metricbeat with a username and password. See: - The 4th item on the [Configure Metricbeat instructions](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-configuration.html#metricbeat-configuration) - The [Username](https://www.elastic.co/guide/en/beats/metricbeat/current/elasticsearch-output.html#_literal_username_literal_2) and Password configuration options. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 7, 2018, 4:30am UTC](https://discuss.elastic.co/t/can-not-setup-beat-templates-on-elasticsearch-nodes/155943/3 "2018-12-07T04:30:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.