# Filebeat-0SS throwing error while connecting with AWS ES
**URL:** https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402
**Category:** Beats
**Tags:** filebeat
**Created:** [April 29, 2020, 3:51pm UTC](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402 "2020-04-29T15:51:24Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Rakesh\_Joshi3107](https://discuss.elastic.co/u/Rakesh_Joshi3107)
#### Post date: [April 29, 2020, 3:51pm UTC](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402/1 "2020-04-29T15:51:24Z")
Hi,
I'm trying to use Filebeat-OSS with AWS ES to ingest AWS ECS Container logs, I'm getting that Filebeat is not able to connect with ES.
"2020-04-29T15:40:54.266Z ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch([https://xxx-us-east-1.es.amazonaws.com:443/](https://xxx-us-east-1.es.amazonaws.com:443/))): Connection marked as failed because the onConnect callback failed: request checking for ILM availability failed: 401 Unauthorized: {"Message":"Your request: '/\_xpack' is not allowed."} "
**Here is my docker file**
```auto
FROM docker.elastic.co/beats/filebeat-oss:7.6.2
COPY filebeat.yml /usr/share/filebeat/filebeat.yml
USER root
RUN chmod 777 /usr/share/filebeat/
RUN chown root:filebeat /usr/share/filebeat/
USER filebeat
```
**Here is my filebeat.yml**
```auto
filebeat.inputs:
- type: container
paths:
- /var/lib/docker/containers/*/*.log
output.elasticsearch:
hosts: ['https://xxx.us-east-1.es.amazonaws.com:443/']
ilm.enabled: auto
index: "ecs-dev-%{+YYYY.MM.dd}"
setup.template:
name: 'ecs-dev'
pattern: 'ecs-dev-*'
enabled: false
```
#============================== Xpack Monitoring ===============================
```auto
xpack.monitoring.enabled: false
```
And If I use Filebeat with Logstash for this, its working fine but I'm want directly to use Filebeat to get ECS exported fields which i cannot get with logstash.
Thanks,
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [April 29, 2020, 4:18pm UTC](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402/2 "2020-04-29T16:18:33Z")
I believe you need to disable ILM rather than have it set to auto.
---
### Author:  [@Rakesh\_Joshi3107](https://discuss.elastic.co/u/Rakesh_Joshi3107)
#### Post date: [April 29, 2020, 4:34pm UTC](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402/3 "2020-04-29T16:34:33Z")
I have tried with **ilm.enabled: false** , but still getting the same error.
---
### Author:  [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [April 29, 2020, 5:25pm UTC](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402/4 "2020-04-29T17:25:51Z")
> [@Rakesh\_Joshi3107](#):
>
> request checking for ILM availability failed
Please add also `setup.ilm.enabled: false` at the root of the configuration.
`filebeat.yml`
```auto
filebeat.inputs:
- type: container
paths:
- /var/lib/docker/containers/*/*.log
output.elasticsearch:
hosts: ['https://xxx.us-east-1.es.amazonaws.com:443/']
ilm.enabled: false
index: "ecs-dev-%{+YYYY.MM.dd}"
setup.template:
name: 'ecs-dev'
pattern: 'ecs-dev-*'
enabled: false
setup.ilm.enabled: false
```
---
### Author:  [@Rakesh\_Joshi3107](https://discuss.elastic.co/u/Rakesh_Joshi3107)
#### Post date: [April 29, 2020, 6:19pm UTC](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402/5 "2020-04-29T18:19:24Z")
> [@Luca\_Belluccini](#):
>
> setup.ilm.enabled: false
Thanks a lot @Luca_Belluccini, it worked.
Can you please help in another issue, i'm using filebeat as daemonset in AWS ECS and i'm not ECS exported fields. Basically i want to get some basic informations of docker containers to identify the logs(e.g. Container name, etc.).
---
### Author:  [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [April 29, 2020, 6:38pm UTC](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402/6 "2020-04-29T18:38:37Z")
Can you try adding `add_docker_metadata`:
```auto
filebeat.inputs:
- type: container
paths:
- /var/lib/docker/containers/*/*.log
processors:
- add_docker_metadata: ~
```
---
### Author:  [@Rakesh\_Joshi3107](https://discuss.elastic.co/u/Rakesh_Joshi3107)
#### Post date: [April 29, 2020, 7:06pm UTC](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402/7 "2020-04-29T19:06:34Z")
No @Luca_Belluccini, it didn't worked.
````auto
filebeat.inputs:
- type: container
paths:
- /var/lib/docker/containers/*/*.log
processors:
- add_docker_metadata: ~
output.elasticsearch:
hosts: ['https://vpc-elasticsearch-1-qb6jzysg4sqjyyiyrlmujrhc3i.us-east-1.es.amazonaws.com:443/']
ilm.enabled: auto
index: "ecs-dev-%{+YYYY.MM.dd}"
setup.template:
name: 'ecs-dev'
pattern: 'ecs-dev-*'
enabled: false
setup.ilm.enabled: false ```
````
---
### Author:  [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [April 29, 2020, 7:14pm UTC](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402/8 "2020-04-29T19:14:45Z")
Please check if Filebeat has access to the Docker sock as explained here
[https://www.elastic.co/guide/en/beats/filebeat/master/add-docker-metadata.html](https://www.elastic.co/guide/en/beats/filebeat/master/add-docker-metadata.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 27, 2020, 7:14pm UTC](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402/9 "2020-05-27T19:14:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.