Connection marked as failed because the onConnect callback failed: resource 'filebeat-7.5.1' exists, but it is not an alias"

[Flaviu]

Hello,

I have just installed a new server with filebeat 7.5.1 and for some reason, after I restart the filebeat or the server I get this error:

Connection marked as failed because the onConnect callback failed: 
resource 'filebeat-7.5.1' exists, but it is not an alias"

if I go in kibana and delete the "filebeat-7.5.1" index I start to see logs coming in in the kibana/elasticsearch server, and the above error disappears from the filebeat error logs.

If I restart the filebeat process or the server altogether the above error starts to appear again and the logs are not pus anymore in kibana/elasticsearch. Te repair this I just need to go back to kibana and delete the index.

I have some more servers with a different version of filebeat and I don't have this issue.

Am I doing something wrong?

Thank you,

[faec (Fae Charlton)]

Could you share your filebeat configuration? You can preserve the formatting by putting triple backticks (```) on the lines before and after the config. It looks like your problems are related to ILM (see here), but I'd need to see the configuration to say more. Are you possibly using more than one filebeat with the same elasticsearch server? If so, they might have conflicting index settings.

[TCBeeekley (Tim Beekley)]

I'm having this same issue, running Filebeat to ship logs from k8s (AWS EKS) to Elastic Cloud.