Can we use filebeat to send data to AWS elasticsearch service?

Elastic Stack Beats
1

I am trying to send log data of my nginx server to AWS elasticsearch service. i am done with the changes in filebeat.yml file and then run the command "filebeat setup" but then i got the error like " Overwriting ILM policy is disabled. Set setup.ilm.overwrite: true for enabling.

Exiting: request checking for ILM availability failed: 401 Unauthorized: {"Message":"Your request: '/_xpack' is not allowed."}
". So can anyone please help me to come out of this error?
Thanks

2

Hi, Looks like you have made changes to the default index name (filebeat*). Which means you need to enable the default ILM config to be overridden by setting setup.ilm.overwrite to true.

3

Hi, i did not made any changes to the index i left them as default. But as you said i made setup.ilm.overwrite to true but hen also the same error is repeated as mentiond above

Thanks

4

AWS Elasticsearch Service does not supports ILM. You need to completely disable it with setup.ilm.enabled: false.

5

I think that you need to download this version:

BTW did you look at Cloud by Elastic, also available if needed from AWS Marketplace ?

Cloud by elastic is one way to have access to all features, all managed by us. Think about what is there yet like Security, Monitoring, Reporting, SQL, Canvas, Maps UI, Alerting and built-in solutions named Observability, Security, Enterprise Search and what is coming next :slight_smile: ...

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.