# Filebeat errors on setup - Apache ingest pipelines failing to load

**URL:** <https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 22, 2021, 10:45pm UTC](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134 "2021-02-22T22:45:21Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![QueenAmidala](https://avatars.discourse-cdn.com/v4/letter/q/ce7236/32.png) [@QueenAmidala](https://discuss.elastic.co/u/QueenAmidala)\
**Post date:** [February 22, 2021, 10:45pm UTC](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134/1 "2021-02-22T22:45:21Z")

</div>

So here is my problem it seems filbeats setup is failing for me. I get a bunch of empty error messages

` **"Exiting: 1 error: Error setting up ML for apache_ecs: 17 errors: ; ; ; ; ; ; ; ; ; ; error while".** `

I'm thinking that this is because the error structure used by filebeats is wrong.  
The structure is defined here: [beats/importer.go at v7.11.1 · elastic/beats · GitHub](https://github.com/elastic/beats/blob/v7.11.1/libbeat/ml-importer/importer.go#L69).

And, the errors get appeneded here:[beats/importer.go at v7.11.1 · elastic/beats · GitHub](https://github.com/elastic/beats/blob/v7.11.1/libbeat/ml-importer/importer.go#L221).

The errors in the response looks more like: [kibana/types.ts at v7.11.1 · elastic/kibana · GitHub](https://github.com/elastic/kibana/blob/v7.11.1/x-pack/plugins/ml/common/util/errors/types.ts#L16).

There was a merge request a while ago that looks like it changed the error responses [https://github.com/elastic/kibana/pull/74965](https://github.com/elastic/kibana/pull/74965).

Does anyone know if filebeats is representing errors incorrectly or is this just another kind of error it doesn't know about?

The errors are just datafeed and job conflicts which it looks like the code was trying to watch for.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 22, 2021, 11:22pm UTC](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134/2 "2021-02-22T23:22:30Z")

</div>

Hi @QueenAmidala Welcome to the community.

Long story short, don't worry about that right now... it has to do with some legacy ml jobs / mapping and should not be an issue.

Curious what version you are running though?

Go ahead and run filebeat and use the Visualizations, Dashboards, Alerts actions as you see fit let us know if you have any issues.

Thanks for checking in with this.

---

<div class="post-metadata">

**Author:** ![QueenAmidala](https://avatars.discourse-cdn.com/v4/letter/q/ce7236/32.png) [@QueenAmidala](https://discuss.elastic.co/u/QueenAmidala)\
**Post date:** [February 23, 2021, 4:02am UTC](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134/3 "2021-02-23T04:02:06Z")

</div>

This seems to also be a problem for these people [Error trying to setup filebeat](https://discuss.elastic.co/t/error-trying-to-setup-filebeat/257011) because the error response structure for a visualization is actually more like [kibana/types.ts at v7.11.1 · elastic/kibana · GitHub](https://github.com/elastic/kibana/blob/v7.11.1/x-pack/plugins/ml/common/util/errors/types.ts#L26) when you run filebeats setup for the first time and the error message doesn't match with what is looked for in the code.

Is there no desire to fix this because it is legacy code? Can the machine learning option for filebeat setup at least be disabled by default?

I'm using version 7.11.1 of Elastic. So, like Elasticsearch 7.11.1, Kibana 7.11.1, and Filebeat 7.11.1. I'm using the container images.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 23, 2021, 4:35am UTC](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134/4 "2021-02-23T04:35:45Z")

</div>

Hi @QueenAmidala

Thank you for opening the issue, I will poke engineering a bit tomorrow if I get a chance. When I asked before (as I ran into myself) I was told this will be fixed in / mitigated in a future release and at this point it is does not indicate any actual issues.

Is there any functionality other than the error message that is broken for you? If so let us know, otherwise I would proceed with the stack.

If you are using 7.11.1 and enable apache and / or ngnix and then run setup the correct ML jobs will be loaded.

I just built a brand new stack ...

```
$ ./filebeat modules enable apache nginx 
$ Enabled apache
$ Enabled nginx

$ ./filebeat setup
......
Exiting: 3 errors: Error setting up ML for apache_ecs: 10 errors: ; ; ; ; ; ; ; ; ; ; Error setting up ML for apache_ecs: 10 errors: ; ; ; ; ; ; ; ; ; ; Error setting up ML for nginx_ecs: 10 errors: ; ; ; ; ; ; ; ; ; 

```

I get the same error however when I go into Kibana the correct ML jobs are loaded for apache and nginx, my understanding is that is what would be broken if it was an actual issue.

 ![Screen Shot 2021-02-22 at 8.24.55 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/5/75ae434270e439570b552807a79f9ad034b530da.png)

---

<div class="post-metadata">

**Author:** ![QueenAmidala](https://avatars.discourse-cdn.com/v4/letter/q/ce7236/32.png) [@QueenAmidala](https://discuss.elastic.co/u/QueenAmidala)\
**Post date:** [February 23, 2021, 1:48pm UTC](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134/5 "2021-02-23T13:48:09Z")

</div>

It is a conflict error about a resource already existing since Nginx and Apache use the same names for things. But it has other repercussions besides being an error message, for example the filebeat setup command fails with a failing exit code, and also the pipeline loading gets skipped because it happens after the error

> <https://github.com/elastic/beats/blob/v7.11.1/libbeat/cmd/instance/beat.go#L578>

It's also not very intuitive to see empty error messages instead of the actual errors.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 23, 2021, 3:30pm UTC](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134/6 "2021-02-23T15:30:39Z")

</div>

Hi @QueenAmidala

Yeah agree needs to be fixed, interesting I was about to tell you that the pipelines are being added because the nginx pipeline is loaded but the apache pipelines are not loaded! That is not good.

Could you add to your issues that the apache ingest pipelines are failing to load. (Bad error messages are one thing but failing to load the pipeline is not good at all) I will pass on the issue to engineering.

Actually if you editing the Title to something like

`Filebeat errors on setup - Apache ingest pipelines failing to load`

That would probably get more attention.

Thanks again.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 23, 2021, 4:05pm UTC](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134/7 "2021-02-23T16:05:06Z")

</div>

As a workaround in the meantime you can run the following to manually load the pipelines.

`./filebeat setup --modules=apache --pipelines`

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 23, 2021, 10:24pm UTC](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134/8 "2021-02-23T22:24:50Z")

</div>

Hi @QueenAmidala

Thanks again as you can see Engineering has picked up your [Github issue.](https://github.com/elastic/beats/issues/24192)

Above I was hoping that you would update the Github Issue Title... to

`Filebeat errors on setup - Apache ingest pipelines failing to load`

Its a little more descriptive

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2021, 12:24am UTC](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134/9 "2021-03-24T00:24:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
