Filebeat: Incorrect HTTP method after upgrade to 7.13

Hi There,

I'm using filebeat on a windows server with iis module enabled. After upgrading from 7.10 to 7.13 it starts writing this error. I don't understand why, because the documentation lists PUT method and I don't think that this could get configured.

Any suggestions to me?

2021-07-06T13:23:16.117Z	INFO	[esclientleg]	eslegclient/connection.go:314	Attempting to connect to Elasticsearch version 7.13.0
2021-07-06T13:23:16.171Z	INFO	[index-management]	idxmgmt/std.go:261	Auto ILM enable success.
2021-07-06T13:23:16.198Z	INFO	[index-management.ilm]	ilm/std.go:160	ILM policy filebeat exists already.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:401	Set to '{filebeat-7.13.2 {now/d}-000001}' as ILM is enabled.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:406	Set setup.template.pattern to 'filebeat-7.13.2-*' as ILM is enabled.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:440	Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.13.2 {now/d}-000001} as ILM is enabled.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:444	Set in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2021-07-06T13:23:16.228Z	INFO	template/load.go:111	Template filebeat-7.13.2 already exists and will not be overwritten.
2021-07-06T13:23:16.228Z	INFO	[index-management]	idxmgmt/std.go:297	Loaded index template.
2021-07-06T13:23:16.370Z	ERROR	[index-management.ilm]	ilm/std.go:128	Index Alias filebeat-7.13.2 setup failed: failed to create alias: {"error":"Incorrect HTTP method for uri [/%3Cfilebeat-7.13.2-%7Bnow/d%7D-000001%3E] and method [PUT], allowed: [POST]","status":405}: 405 Method Not Allowed: {"error":"Incorrect HTTP method for uri [/%3Cfilebeat-7.13.2-%7Bnow/d%7D-000001%3E] and method [PUT], allowed: [POST]","status":405}.

Hey @all,

I've checked some documentation and try to debug the problem.
As far as I can see, the request should be valid: Rollover API | Elasticsearch Guide [7.13] | Elastic

But ElasticSearch says, that the wrong method is called.
Has anyone an idea, what went wrong here? Why does ElasticSearch behave different then in documentation?


Could you please share the config file? I'm not sure about entities %3C, %3E in /%3Cfilebeat-7.13.2-%7Bnow/d%7D-000001%3E.

It's basicly the default-configuration of filebeat (Windows) with Module "IIS" enabled.

The requests looks like https://my-elastic-host/<filebeat-7.13.2-{now/d}>/. The response contains the escaped entities.

The only setting changed is

  # Array of hosts to connect to.
  hosts: [""]
  proxy_url: x.x.x.x:8080

  # Protocol - either `http` (default) or `https`.
  protocol: "https"

  username: xxx
  password: xxx

The proxy couldn't be the problem. I've send a PUT Request directly to the elasticsearch server.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.