# Can't load filebeat Index Template in Elasticsearch

**URL:** <https://discuss.elastic.co/t/cant-load-filebeat-index-template-in-elasticsearch/190836>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 16, 2019, 10:06pm UTC](https://discuss.elastic.co/t/cant-load-filebeat-index-template-in-elasticsearch/190836 "2019-07-16T22:06:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saber.Tala](https://avatars.discourse-cdn.com/v4/letter/s/ecb155/32.png) [@Saber.Tala](https://discuss.elastic.co/u/Saber.Tala)\
**Post date:** [July 16, 2019, 10:06pm UTC](https://discuss.elastic.co/t/cant-load-filebeat-index-template-in-elasticsearch/190836/1 "2019-07-16T22:06:15Z")

</div>

Hello,

Using Filebeat version 7.2.0, Logstash version 7.1.1 and ElasticSearch version 7.1.1, when I try to  
load Filebeat Index Template in Elasticsearch, I get the following error:

```
[root@VM1 ~]# curl -XPUT 'http://localhost:9200/_template/filebeat?pretty' -d@filebeat-index-template.json
{
  "error" : "Content-Type header [application/x-www-form-urlencoded] is not supported",
  "status" : 406
}

```

And below is the content of the filebeat-index-template.json

```
{
  "mappings": {
    "_default_": {
      "_all": {
        "enabled": true,
        "norms": {
          "enabled": false
        }
      },
      "dynamic_templates": [
        {
          "template1": {
            "mapping": {
              "doc_values": true,
              "ignore_above": 1024,
              "index": "not_analyzed",
              "type": "{dynamic_type}"
            },
            "match": "*"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "string",
          "index": "analyzed"
        },
        "offset": {
          "type": "long",
          "doc_values": "true"
        },
        "geoip" : {
          "type" : "object",
          "dynamic": true,
          "properties" : {
            "location" : { "type" : "geo_point" }
          }
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "filebeat-*"
}

```

I followed the steps from here:

> **[How To Install Elasticsearch, Logstash, and Kibana (ELK Stack) on CentOS 7 |...](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7)**
>
> In this tutorial, we will go over the installation of the Elasticsearch ELK Stack on CentOS 7—that is, Elasticsearch 2.1.x, Logstash 2.1.x, and Kibana 4.3.x. We will also show you how to configure it to gather and visualize the syslogs of your...

and my OS is Centos 7

---

<div class="post-metadata">

**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\
**Post date:** [July 17, 2019, 9:01am UTC](https://discuss.elastic.co/t/cant-load-filebeat-index-template-in-elasticsearch/190836/2 "2019-07-17T09:01:53Z")

</div>

Look here for valid curl example with proper, required content type header:  
[https://www.elastic.co/guide/en/beats/filebeat/7.2/filebeat-template.html#load-template-manually-alternate](https://www.elastic.co/guide/en/beats/filebeat/7.2/filebeat-template.html#load-template-manually-alternate)

Also your going off of way too old tutorial for ES 2 when you are actually using 7.  
Which means you will have all sorts of issue because your doc is not for the right version. For example your index template is not ok for V7 of ES. You should read the official doc for your version or at least docs and blog posts which refer to ES version 7.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2019, 9:02am UTC](https://discuss.elastic.co/t/cant-load-filebeat-index-template-in-elasticsearch/190836/3 "2019-08-14T09:02:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.