# ERR Failed to connect: Connection marked as failed because the onConnect callback failed: Error loading Elasticsearch template: could not load template: couldn't load template: couldn't load json. Error: 400 Bad Request **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 16, 2019, 11:02am UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071 "2019-04-16T11:02:31Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![ishu52](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ishu52/32/44325_2.png) [@ishu52](https://discuss.elastic.co/u/ishu52)\ **Post date:** [April 16, 2019, 11:02am UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/1 "2019-04-16T11:02:32Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/1/0/105a298fce966f5c71defc4924b8bee6db660bf8.png) I get this error when I deploy filebeat. it was tested before with 6.6.1 version and was working fine but now the same yaml is giving this error. ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b3074a733381170d02aee436f360e94cfbb0d933.png) ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [April 16, 2019, 11:22am UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/2 "2019-04-16T11:22:28Z")
Hi @ishu52 and welcome 🙂 What version of filebeat are you using? Filebeat \< 6.7.0 versions are incompatible with Elasticsearch 7.0. You can check the supported versions matrix in [https://www.elastic.co/es/support/matrix#matrix\_compatibility](https://www.elastic.co/es/support/matrix#matrix_compatibility) ---
**Author:** ![ishu52](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ishu52/32/44325_2.png) [@ishu52](https://discuss.elastic.co/u/ishu52)\ **Post date:** [April 16, 2019, 12:02pm UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/3 "2019-04-16T12:02:19Z")
the version was 6.0.1. Now I pointed to 7.0.0 and getting below error. Pod is going to 'CrashLoopBackOff' state ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/d/8de269d434a98b30ca80c17a369bfee1ad1305b1.png) ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [April 16, 2019, 5:32pm UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/4 "2019-04-16T17:32:27Z")
As the error message says, `filebeat.config.prospectors` has been removed. Prospectors were removed to inputs and both options were accepted during a time. Now you have to use [`filebeat.inputs`](https://www.elastic.co/guide/en/beats/filebeat/7.0/configuration-filebeat-options.html) instead. Take a look to the [release notes](https://www.elastic.co/guide/en/beats/libbeat/7.0/release-notes.html), this and other breaking changes are listed there. ---
**Author:** ![ishu52](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ishu52/32/44325_2.png) [@ishu52](https://discuss.elastic.co/u/ishu52)\ **Post date:** [April 17, 2019, 11:33am UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/5 "2019-04-17T11:33:17Z")
Thank you @jsoriano. It is working. but compared to previous version 6.0.1, with 7.0.0 i cannot see any data on fields like namespace, container name, requestid etc. It is just showing index type, index id, message ---
**Author:** ![ishu52](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ishu52/32/44325_2.png) [@ishu52](https://discuss.elastic.co/u/ishu52)\ **Post date:** [April 19, 2019, 7:25am UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/6 "2019-04-19T07:25:31Z")
Hi, I have removed filebeat.config.prospectors and added filebeat.input. Now i want kubernetes log to be forwarded for which in prospectors config 'add\_kubernetes\_metadata' was added. with latest 7.0.0 ,I am adding preprocessor in filebeat.yml ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c5fd215e5632cb177cd3693a1580bc379af0e73c.png) Output: Not able to read logs from kubernetes pods Expectation: read logs from kubernetes pods ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [April 19, 2019, 5:26pm UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/7 "2019-04-19T17:26:40Z")
Hi @ishu52, Are your pod logs in `/var/data/kubeletlogs`? Are these files accessible from the filebeat pod? You can also use [autodiscover](https://www.elastic.co/guide/en/beats/filebeat/7.0/configuration-autodiscover.html) to collect logs from all your pods, using autodiscover also adds the metadata to the messages of each pod automatically. But this may require further configuration if you don't have your logs in `/var/lib/docker/containers`. ---
**Author:** ![ishu52](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ishu52/32/44325_2.png) [@ishu52](https://discuss.elastic.co/u/ishu52)\ **Post date:** [April 21, 2019, 2:53pm UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/8 "2019-04-21T14:53:11Z")
Yes logs are available at var/data/kubeletlogs and are getting harvested as well. Since the cluster is containerd so logs are not coming to var/lib/docker/containers ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [April 23, 2019, 12:47pm UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/9 "2019-04-23T12:47:56Z")
@ishu52 you mentioned that with 6.0.1 you were being able to collect kubernetes metadata (namespace, container...), what configuration were you using for that? ---
**Author:** ![ishu52](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ishu52/32/44325_2.png) [@ishu52](https://discuss.elastic.co/u/ishu52)\ **Post date:** [April 24, 2019, 10:18am UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/10 "2019-04-24T10:18:24Z")
I was using prospectors config. As suggested by you, I tried with Autodiscover feature and it is working fine now. Thanks ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [April 24, 2019, 11:03am UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/11 "2019-04-24T11:03:31Z")
Good to read that this is working for you now, could you please share the autodiscover configuration that works for you in case someone else finds this issue in the future? ---
**Author:** ![ishu52](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ishu52/32/44325_2.png) [@ishu52](https://discuss.elastic.co/u/ishu52)\ **Post date:** [April 25, 2019, 7:01am UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/12 "2019-04-25T07:01:26Z")
Here is the configuration: ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/9/997fdf15dde48d20a9bfa3ad389908ec8cbd90b3.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 23, 2019, 7:01am UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template-could-not-load-template-couldnt-load-template-couldnt-load-json-error-400-bad-request/177071/13 "2019-05-23T07:01:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.