# Can we use filebeat to send data to AWS elasticsearch service?

**URL:** https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166
**Category:** Beats
**Tags:** filebeat
**Created:** [December 1, 2020, 7:17am UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166 "2020-12-01T07:17:41Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Ashok4512](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Ashok4512](https://discuss.elastic.co/u/Ashok4512)
#### Post date: [December 1, 2020, 7:17am UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166/1 "2020-12-01T07:17:41Z")

</div>

I am trying to send log data of my nginx server to AWS elasticsearch service. i am done with the changes in filebeat.yml file and then run the command "filebeat setup" but then i got the error like " Overwriting ILM policy is disabled. Set `setup.ilm.overwrite: true` for enabling.

Exiting: request checking for ILM availability failed: 401 Unauthorized: {"Message":"Your request: '/\_xpack' is not allowed."}  
". So can anyone please help me to come out of this error?  
Thanks

---

<div class="post-metadata">

### Author: ![Jeeth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeeth/32/71724_2.png) [@Jeeth](https://discuss.elastic.co/u/Jeeth)
#### Post date: [December 1, 2020, 8:10am UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166/2 "2020-12-01T08:10:00Z")

</div>

Hi, Looks like you have made changes to the default index name (filebeat\*). Which means you need to enable the default ILM config to be overridden by setting setup.ilm.overwrite to true.

---

<div class="post-metadata">

### Author: ![Ashok4512](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Ashok4512](https://discuss.elastic.co/u/Ashok4512)
#### Post date: [December 1, 2020, 8:17am UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166/3 "2020-12-01T08:17:56Z")

</div>

Hi, i did not made any changes to the index i left them as default. But as you said i made setup.ilm.overwrite to true but hen also the same error is repeated as mentiond above

Thanks

---

<div class="post-metadata">

### Author: ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)
#### Post date: [December 1, 2020, 10:41am UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166/4 "2020-12-01T10:41:35Z")

</div>

AWS Elasticsearch Service does not supports ILM. You need to completely disable it with `setup.ilm.enabled: false`.

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [December 1, 2020, 5:49pm UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166/5 "2020-12-01T17:49:52Z")

</div>

I think that you need to download this version:

> **[Download Filebeat • Lightweight Log Analysis | Elastic](https://www.elastic.co/downloads/beats/filebeat-oss)**

BTW did you look at [Cloud by Elastic](https://www.elastic.co/cloud), also available if needed from [AWS Marketplace](https://aws.amazon.com/marketplace/pp/B01N6YCISK) ?

Cloud by elastic is one way to have access to **all features** , all managed by us. Think about what is there yet like Security, Monitoring, Reporting, SQL, Canvas, Maps UI, Alerting and built-in solutions named [Observability](https://www.elastic.co/observability), [Security](https://www.elastic.co/security), [Enterprise Search](https://www.elastic.co/enterprise-search) and what is coming next 🙂 ...

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 29, 2020, 5:50pm UTC](https://discuss.elastic.co/t/can-we-use-filebeat-to-send-data-to-aws-elasticsearch-service/257166/6 "2020-12-29T17:50:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
