# Can't setup filebeat

**URL:** https://discuss.elastic.co/t/cant-setup-filebeat/271843
**Category:** Beats
**Tags:** filebeat
**Created:** [April 30, 2021, 10:14pm UTC](https://discuss.elastic.co/t/cant-setup-filebeat/271843 "2021-04-30T22:14:04Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![angeling](https://avatars.discourse-cdn.com/v4/letter/a/b38774/32.png) [@angeling](https://discuss.elastic.co/u/angeling)
#### Post date: [April 30, 2021, 10:14pm UTC](https://discuss.elastic.co/t/cant-setup-filebeat/271843/1 "2021-04-30T22:14:05Z")

</div>

Can anyone help me? I've an elk intance, it's working well, but when I try to setup a new filebeat in another instance it throws me the following:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/d/dd575ebfc8e3cfbe90e237fb00ae7cd53219c30f.png)

I read that I could remove the filebeat index and then it would work fine.  
I'm new to elk, so I don't know if that would delete some important info. I have the version 7.9.3 and the filebeat.yml has the default configuration, I just added the cloud.id and cloud.auth for it to work. I've to do this for some linux instances.

---

<div class="post-metadata">

### Author: ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [May 1, 2021, 9:22pm UTC](https://discuss.elastic.co/t/cant-setup-filebeat/271843/2 "2021-05-01T21:22:19Z")

</div>

So yes, you would need to remove the existing index so the alias can be made OR use a different index alias. You would only lose info if the index has data in it and is being used. You could create a new index and reindex the existing data if needed

---

<div class="post-metadata">

### Author: ![angeling](https://avatars.discourse-cdn.com/v4/letter/a/b38774/32.png) [@angeling](https://discuss.elastic.co/u/angeling)
#### Post date: [May 3, 2021, 2:55pm UTC](https://discuss.elastic.co/t/cant-setup-filebeat/271843/3 "2021-05-03T14:55:19Z")

</div>

Thank you

how can I use a different index alias? I seached in the filebeat.yml and there wasn't related to alias

---

<div class="post-metadata">

### Author: ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [May 3, 2021, 2:56pm UTC](https://discuss.elastic.co/t/cant-setup-filebeat/271843/4 "2021-05-03T14:56:55Z")

</div>

see [Configure index lifecycle management | Filebeat Reference [7.12] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html#ilm) for the ILM roll over alias setting

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 31, 2021, 4:57pm UTC](https://discuss.elastic.co/t/cant-setup-filebeat/271843/5 "2021-05-31T16:57:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.