Filebeat: Incorrect HTTP method after upgrade to 7.13

[PascalTurbo]

Hi There,

I'm using filebeat on a windows server with iis module enabled. After upgrading from 7.10 to 7.13 it starts writing this error. I don't understand why, because the documentation lists PUT method and I don't think that this could get configured.

Any suggestions to me?

2021-07-06T13:23:16.117Z	INFO	[esclientleg]	eslegclient/connection.go:314	Attempting to connect to Elasticsearch version 7.13.0
2021-07-06T13:23:16.171Z	INFO	[index-management]	idxmgmt/std.go:261	Auto ILM enable success.
2021-07-06T13:23:16.198Z	INFO	[index-management.ilm]	ilm/std.go:160	ILM policy filebeat exists already.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:401	Set setup.template.name to '{filebeat-7.13.2 {now/d}-000001}' as ILM is enabled.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:406	Set setup.template.pattern to 'filebeat-7.13.2-*' as ILM is enabled.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:440	Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.13.2 {now/d}-000001} as ILM is enabled.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:444	Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2021-07-06T13:23:16.228Z	INFO	template/load.go:111	Template filebeat-7.13.2 already exists and will not be overwritten.
2021-07-06T13:23:16.228Z	INFO	[index-management]	idxmgmt/std.go:297	Loaded index template.
2021-07-06T13:23:16.370Z	ERROR	[index-management.ilm]	ilm/std.go:128	Index Alias filebeat-7.13.2 setup failed: failed to create alias: {"error":"Incorrect HTTP method for uri [/%3Cfilebeat-7.13.2-%7Bnow/d%7D-000001%3E] and method [PUT], allowed: [POST]","status":405}: 405 Method Not Allowed: {"error":"Incorrect HTTP method for uri [/%3Cfilebeat-7.13.2-%7Bnow/d%7D-000001%3E] and method [PUT], allowed: [POST]","status":405}.

[PascalTurbo]

Hey @all,

I've checked some documentation and try to debug the problem.
As far as I can see, the request should be valid: Rollover API | Elasticsearch Guide [7.13] | Elastic

But ElasticSearch says, that the wrong method is called.
Has anyone an idea, what went wrong here? Why does ElasticSearch behave different then in documentation?

Bests
Pascal

[mtojek (Marcin Tojek)]

Could you please share the config file? I'm not sure about entities %3C, %3E in /%3Cfilebeat-7.13.2-%7Bnow/d%7D-000001%3E.

[PascalTurbo]

It's basicly the default-configuration of filebeat (Windows) with Module "IIS" enabled.

The requests looks like https://my-elastic-host/<filebeat-7.13.2-{now/d}>/. The response contains the escaped entities.

The only setting changed is

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["elasticsearch.my.url:443"]
  proxy_url: x.x.x.x:8080

  # Protocol - either `http` (default) or `https`.
  protocol: "https"

  username: xxx
  password: xxx

The proxy couldn't be the problem. I've send a PUT Request directly to the elasticsearch server.