Exiting: resource 'filebeat-7.9.0' exists, but it is not an alias

Elastic Stack Beats
1

hi,

after update to ELK 7.9.0 I deleted the filebeat-7.8.x indexes, templatres and now I see this

Exiting: resource 'filebeat-7.9.0' exists, but it is not an alias

ERROR in the log.

Regards,
Rafal

3 Likes
2

Exiting: resource 'filebeat-7.9.0' exists, but it is not an alias

3

I have the same situation. My filebeat has stopped working after upgrading to 7.9.0. This must be something that the qa didn't notice?
The filebeat log file also says:

Failed to connect to backoff(elasticsearch(http://172.16.0.1:9200)): Connection marked as failed because the onConnect callback failed: resource 'filebeat-7.9.0' exists, but it is not an alias

4

I deleted all templates and configs for filebeat-7.8.0 and filebeat-7.8.1 and added this

image

to my filebeat-7.9.0 index. It looks good.

By in Kibana I see often the mesage "Message now allowed". This is new after the update.

5

I forgot to add the log entry ...

==> filebeat/filebeat <==
2020-08-20T01:42:41.965+0200    INFO    [index-management]      idxmgmt/std.go:274      ILM policy successfully loaded.
2020-08-20T01:42:41.966+0200    INFO    [index-management]      idxmgmt/std.go:407      Set setup.template.name to '{filebeat-7.9.0 {now/d}-000001}' as ILM is enabled.
2020-08-20T01:42:41.966+0200    INFO    [index-management]      idxmgmt/std.go:412      Set setup.template.pattern to 'filebeat-7.9.0-*' as ILM is enabled.
2020-08-20T01:42:41.966+0200    INFO    [index-management]      idxmgmt/std.go:446      Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.9.0 {now/d}-000001} as ILM is enabled.
2020-08-20T01:42:41.966+0200    INFO    [index-management]      idxmgmt/std.go:450      Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2020-08-20T01:42:41.967+0200    INFO    template/load.go:169    Existing template will be overwritten, as overwrite is enabled.
2020-08-20T01:42:42.689+0200    INFO    template/load.go:109    Try loading template filebeat-7.9.0 to Elasticsearch
2020-08-20T01:42:42.828+0200    INFO    template/load.go:101    template with name 'filebeat-7.9.0' loaded.
2020-08-20T01:42:42.828+0200    INFO    [index-management]      idxmgmt/std.go:298      Loaded index template.
2020-08-20T01:42:42.831+0200    ERROR   instance/beat.go:951    Exiting: resource 'filebeat-7.9.0' exists, but it is not an alias
6

Having the same error. Brand new 7.9.0 ELK setup. Using filebeats --> elasticsearch for my Fortinet module.

1 Like
7

having same error on brand new filebeat setup

2020-08-31T12:54:53.612+0800    INFO    template/load.go:101    template with name 'filebeat-7.9.0' loaded.
2020-08-31T12:54:53.612+0800    INFO    [index-management]      idxmgmt/std.go:298      Loaded index template.
2020-08-31T12:54:53.612+0800    DEBUG   [esclientleg]   eslegclient/connection.go:364   GET http://localhost:9200/_alias/filebeat-7.9.0  <nil>
2020-08-31T12:54:53.614+0800    DEBUG   [esclientleg]   eslegclient/connection.go:364   HEAD http://localhost:9200/filebeat-7.9.0  <nil>
2020-08-31T12:54:53.616+0800    ERROR   instance/beat.go:951    Exiting: resource 'filebeat-7.9.0' exists, but it is not an alias
Exiting: resource 'filebeat-7.9.0' exists, but it is not an alias
8

I reported this as bug on GitHub.

9

@cripperz can you post you configuration here: https://github.com/elastic/beats/issues/20849

I can't cause I fixed my problem last week.

10

deleted all templates and configs for filebeat-7.8.0 and filebeat-7.8.1 and added this
image

If I may ask, where did you do that?
Is that in Kibana?

--
Regards Falk

11

Yes, I did das in Kibana.

But this Exiting: resource 'metricbeat-7.4.2' exists, but it is not an alias should work too.

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.