# Connect filebeat to elasticsearch

**URL:** <https://discuss.elastic.co/t/connect-filebeat-to-elasticsearch/150240>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 27, 2018, 6:32pm UTC](https://discuss.elastic.co/t/connect-filebeat-to-elasticsearch/150240 "2018-09-27T18:32:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mcoa](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@mcoa](https://discuss.elastic.co/u/mcoa)\
**Post date:** [September 27, 2018, 6:32pm UTC](https://discuss.elastic.co/t/connect-filebeat-to-elasticsearch/150240/1 "2018-09-27T18:32:23Z")

</div>

Hello,  
i've a `filebeat-6.4.1-1` and try connect to ELK (`elasticsearch-5.6` and `kibana-5.6.12`) but not connect and not index create in to Kibana. My filebeat.yml is:

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/auth.log
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
setup.kibana:
  host: 192.168.x.x:5601
output.elasticsearch:
  hosts: ["http://192.168.x.x:9200"]
  template.name: filebeat
  template.path: filebeat.template.json

```

And the filebeat message:

```auto
2018-09-27T14:28:44.900-0400 WARN elasticsearch/client.go:520 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbee36636f39b2454, ext:280057474517, loc:(*time.Location)(0x1f61700)}, Meta:common.MapStr(nil), Fields:common.MapStr{"beat":common.MapStr{"name":"monitor.example.lab", "hostname":"monitor.example.lab", "version":"6.4.1"}, "host":common.MapStr{"name":"monitor.example.lab"}, "source":"/var/log/secure", "offset":30490, "message":"Sep 27 14:28:42 monitor sshd[15486]: pam_unix(sshd:session): session opened for user zimbra4 by (uid=0)", "prospector":common.MapStr{"type":"log"}, "input":common.MapStr{"type":"log"}}, Private:file.State{Id:"", Finished:false, Fileinfo:(*os.fileStat)(0xc4204ff380), Source:"/var/log/secure", Offset:30594, Timestamp:time.Time{wall:0xbee365f0f2e05811, ext:45232592, loc:(*time.Location)(0x1f61700)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x89646, Device:0xfd00}}}, Flags:0x1} (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_default_]: Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, type={ignore_above=1024, type=keyword}, message={norms=false, type=text}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, type={ignore_above=1024, type=keyword}, message={norms=false, type=text}}]"}}

```

```auto
[root@elk ~]# curl localhost:9200/_cat/indices?
yellow open .kibana ej-lfzbnRw2mt2a-WoFn-w 5 1 34 15 189.2kb 189.2kb
yellow open auditbeat-6.4.0-2018.09.27 4v8j_1WkS8WAhedEm2nQ4g 3 1 6625 0 5.9mb 5.9mb
yellow open logstash-2018.09.27 lV7Wxbe-TkWsdSA9ox0UWQ 5 1 316 0 590.6kb 590.6kb

```

Thanks

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [September 28, 2018, 1:09pm UTC](https://discuss.elastic.co/t/connect-filebeat-to-elasticsearch/150240/2 "2018-09-28T13:09:25Z")

</div>

Hello @mcoa

Looking at the error in the log this look like a mapping error.

```auto
Mapping definition for [error] has unsupported parameters:

```

Looking at your configuration, you are providing a custom template with these options:

```auto
 template.name: filebeat
 template.path: filebeat.template.json

```

Unless you really need it I would remove the two options above and use the default templates that filebeat will manage for you.

Also, I see that you are parsing auth log did you take a look at the [system module](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html) which will take care of parsing the auth log and creating dashboard for it?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 26, 2018, 1:09pm UTC](https://discuss.elastic.co/t/connect-filebeat-to-elasticsearch/150240/3 "2018-10-26T13:09:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.