Can't load filebeat Index Template in Elasticsearch

Elastic Stack Beats
1

Hello,

Using Filebeat version 7.2.0, Logstash version 7.1.1 and ElasticSearch version 7.1.1, when I try to
load Filebeat Index Template in Elasticsearch, I get the following error:

[root@VM1 ~]# curl -XPUT 'http://localhost:9200/_template/filebeat?pretty' -d@filebeat-index-template.json
{
  "error" : "Content-Type header [application/x-www-form-urlencoded] is not supported",
  "status" : 406
}

And below is the content of the filebeat-index-template.json

{
  "mappings": {
    "_default_": {
      "_all": {
        "enabled": true,
        "norms": {
          "enabled": false
        }
      },
      "dynamic_templates": [
        {
          "template1": {
            "mapping": {
              "doc_values": true,
              "ignore_above": 1024,
              "index": "not_analyzed",
              "type": "{dynamic_type}"
            },
            "match": "*"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "string",
          "index": "analyzed"
        },
        "offset": {
          "type": "long",
          "doc_values": "true"
        },
        "geoip"  : {
          "type" : "object",
          "dynamic": true,
          "properties" : {
            "location" : { "type" : "geo_point" }
          }
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "filebeat-*"
}

I followed the steps from here:

and my OS is Centos 7

2

Look here for valid curl example with proper, required content type header:
https://www.elastic.co/guide/en/beats/filebeat/7.2/filebeat-template.html#load-template-manually-alternate

Also your going off of way too old tutorial for ES 2 when you are actually using 7.
Which means you will have all sorts of issue because your doc is not for the right version. For example your index template is not ok for V7 of ES. You should read the official doc for your version or at least docs and blog posts which refer to ES version 7.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.