# Configuration using filebeat with static index name **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [October 16, 2019, 1:04pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842 "2019-10-16T13:04:33Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![ptrigo](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@ptrigo](https://discuss.elastic.co/u/ptrigo)\ **Post date:** [October 16, 2019, 1:04pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842/1 "2019-10-16T13:04:33Z")
Hi, I would like to know how I need to configure filebeat to use an existing index(it's empty). What's the configuration to do so? So far I tried in a helm chart: ```auto output.elasticsearch: hosts: 'https://XXXXXX.com:8443' index: 'my-index-filebeat' username: "XXXXX" password: "YYYYY" setup.template: name: 'my-index-filebeat' overwrite: true enabled: true pattern: 'my-index-filebeat' ``` I cannot create index in this elasticsearch server, only use this one. Thanks in advance ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [October 17, 2019, 1:45pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842/2 "2019-10-17T13:45:07Z")
It sounds like you are running into this issue: [https://github.com/elastic/beats/issues/11866](https://github.com/elastic/beats/issues/11866). The workaround is to set `setup.ilm.enabled: false` in your Filebeat configuration. Could you try that and see if the `my-index-filebeat` template and `my-index-filebeat` index get created? Thanks, Shaunak ---
**Author:** ![ptrigo](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@ptrigo](https://discuss.elastic.co/u/ptrigo)\ **Post date:** [October 17, 2019, 2:02pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842/3 "2019-10-17T14:02:43Z")
Thanks Shanuak, I tried with that option but unfortunately it doesn't work. My case it's a little bit uncommon. I need to use the my-index-filebeat index that was created by the elasticsearch admins in my company. I cannot create any index in the elasticsearch server. What should I do to make it work? Logs: > 2019-10-17T13:56:00.894Z INFO pipeline/output.go:93 Attempting to reconnect to backoff(elasticsearch([https://XXXXXXXXXX.com:8443](https://XXXXXXXXXX.com:8443))) with 4 reconnect attempt(s) > 2019-10-17T13:56:00.894Z INFO [publisher] pipeline/retry.go:189 retryer: send unwait-signal to consumer > 2019-10-17T13:56:00.894Z INFO [publisher] pipeline/retry.go:191 done > 2019-10-17T13:56:00.894Z INFO [publisher] pipeline/retry.go:166 retryer: send wait signal to consumer > 2019-10-17T13:56:00.894Z INFO [publisher] pipeline/retry.go:168 done > 2019-10-17T13:56:00.903Z INFO elasticsearch/client.go:743 Attempting to connect to Elasticsearch version 6.8.2 > 2019-10-17T13:56:00.914Z INFO template/load.go:169 Existing template will be overwritten, as overwrite is enabled. > 2019-10-17T13:56:00.984Z INFO template/load.go:108 Try loading template my-index-filebeat to Elasticsearch ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [October 17, 2019, 2:31pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842/4 "2019-10-17T14:31:48Z")
> [@ptrigo](#): > > I need to use the my-index-filebeat index that was created by the elasticsearch admins in my company. I cannot create any index in the elasticsearch server. Indexing into an existing index should be fine; I just tested it to make sure. As a test, could you try to send a [Bulk API request](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-bulk.html#bulk-curl), using the same username+password as in your Filebeat configuration, to `my-index-filebeat` from the command line (using curl or equivalent) on the host where Filebeat is running? That'll tell us if a) a connection can be made from the Filebeat host to the Elasticsearch cluster and b) if the configured user has sufficient privileges to bulk index documents into `my-index-filebeat`. Also, are those all the logs you are seeing for Filebeat? Specifically, are there any log messages showing errors or warnings? Finally, which version of Filebeat are you using? Shaunak ---
**Author:** ![ptrigo](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@ptrigo](https://discuss.elastic.co/u/ptrigo)\ **Post date:** [October 17, 2019, 3:18pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842/5 "2019-10-17T15:18:30Z")
As requested: > $ cat requests > { "index" : { "\_index" : "test", "\_id" : "1" } } > { "field1" : "value1" } > curl -s -H "Content-Type: application/x-ndjson" -XPOST [https://XXXXXX.com:8443/\_bulk](https://XXXXXX.com:8443/_bulk) --data-binary "@requests" -u XXXXXX; echo > Enter host password for user 'XXXXXX': > {"error":{"root\_cause":[{"type":"action\_request\_validation\_exception","reason":"Validation Failed: 1: type is missing;"}],"type":"action\_request\_validation\_exception","reason":"Validation Failed: 1: type is missing;"},"status":400} - Example Connection: > $ curl -XGET "[https://XXXXXXX.com:8443/my-index-filebeat/\_search?pretty=true&q=\*:](https://XXXXXXX.com:8443/my-index-filebeat/_search?pretty=true&q=*:)\*" -u XXXXXX > Enter host password for user 'XXXXXX': > { > "took" : 5, > "timed\_out" : false, > "\_shards" : { > "total" : 1, > "successful" : 1, > "skipped" : 0, > "failed" : 0 > }, > "hits" : { > "total" : 0, > "max\_score" : null, > "hits" : > } > } - I will double check the permissions with our team. - Only I have these INFO messages, get stuck in Try loading template .... - Filebeat version: 7.3.2 Many Thanks. ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [October 17, 2019, 4:44pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842/6 "2019-10-17T16:44:36Z")
> [@ptrigo](#): > > { "index" : { "\_index" : "test", "\_id" : "1" } } Can you try changing this line in `requests` to: ```auto { "index" : { "_index" : "test", "_type": "_doc", "_id" : "1" } } ``` and make the `curl` request again please? ---
**Author:** ![ptrigo](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@ptrigo](https://discuss.elastic.co/u/ptrigo)\ **Post date:** [October 17, 2019, 4:56pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842/7 "2019-10-17T16:56:12Z")
> {"took":9,"errors":true,"items":[{"index":{"\_index":"test","\_type":"\_doc","\_id":"1","status":403,"error":{"type":"security\_exception","reason":"action [indices:admin/create] is unauthorized for user [XXXXX]"}}}]} Just a reminder, I cannot create index only using the existing one. Thanks. ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [October 17, 2019, 5:14pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842/8 "2019-10-17T17:14:53Z")
So is `test` not an existing index? Can you try the bulk request from curl using the same existing index that you would use in your `output.elasticsearch.index` setting? ---
**Author:** ![ptrigo](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@ptrigo](https://discuss.elastic.co/u/ptrigo)\ **Post date:** [October 17, 2019, 5:29pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842/9 "2019-10-17T17:29:28Z")
Sorry, I didn't changed the name of the index, this is the result with my index: > {"took":66,"errors":false,"items":[{"index":{"\_index":"my-index-filebeat","\_type":"\_doc","\_id":"1","\_version":1,"result":"created","\_shards":{"total":2,"successful":2,"failed":0},"\_seq\_no":0,"\_primary\_term":3,"status":201}}]} ---
**Author:** ![ptrigo](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@ptrigo](https://discuss.elastic.co/u/ptrigo)\ **Post date:** [October 17, 2019, 7:12pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842/10 "2019-10-17T19:12:04Z")
> output.elasticsearch: > #hosts: '${ELASTICSEARCH\_HOSTS:elasticsearch-master:9200}' > hosts: '[https://XXXXXX.com:8443](https://XXXXXX.com:8443)' > index: 'my-index-filebeat' > username: "XXXXXX" > password: "YYYYYY" > setup.template: > name: 'my-index-filebeat' > overwrite: true > enabled: false > pattern: 'my-index-filebeat\*' > setup.ilm.enabled: false It seems that enabled: false did the trick. Thanks for your support ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 14, 2019, 7:14pm UTC](https://discuss.elastic.co/t/configuration-using-filebeat-with-static-index-name/203842/11 "2019-11-14T19:14:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.