# Filebeat: Incorrect HTTP method after upgrade to 7.13

**URL:** https://discuss.elastic.co/t/filebeat-incorrect-http-method-after-upgrade-to-7-13/277964
**Category:** Beats
**Tags:** filebeat
**Created:** [July 6, 2021, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-incorrect-http-method-after-upgrade-to-7-13/277964 "2021-07-06T13:37:36Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![PascalTurbo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pascalturbo/32/91244_2.png) [@PascalTurbo](https://discuss.elastic.co/u/PascalTurbo)
#### Post date: [July 6, 2021, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-incorrect-http-method-after-upgrade-to-7-13/277964/1 "2021-07-06T13:37:36Z")

</div>

Hi There,

I'm using filebeat on a windows server with iis module enabled. After upgrading from 7.10 to 7.13 it starts writing this error. I don't understand why, because the documentation lists PUT method and I don't think that this could get configured.

Any suggestions to me?

```auto
2021-07-06T13:23:16.117Z	INFO	[esclientleg]	eslegclient/connection.go:314	Attempting to connect to Elasticsearch version 7.13.0
2021-07-06T13:23:16.171Z	INFO	[index-management]	idxmgmt/std.go:261	Auto ILM enable success.
2021-07-06T13:23:16.198Z	INFO	[index-management.ilm]	ilm/std.go:160	ILM policy filebeat exists already.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:401	Set setup.template.name to '{filebeat-7.13.2 {now/d}-000001}' as ILM is enabled.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:406	Set setup.template.pattern to 'filebeat-7.13.2-*' as ILM is enabled.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:440	Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.13.2 {now/d}-000001} as ILM is enabled.
2021-07-06T13:23:16.198Z	INFO	[index-management]	idxmgmt/std.go:444	Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2021-07-06T13:23:16.228Z	INFO	template/load.go:111	Template filebeat-7.13.2 already exists and will not be overwritten.
2021-07-06T13:23:16.228Z	INFO	[index-management]	idxmgmt/std.go:297	Loaded index template.
2021-07-06T13:23:16.370Z	ERROR	[index-management.ilm]	ilm/std.go:128	Index Alias filebeat-7.13.2 setup failed: failed to create alias: {"error":"Incorrect HTTP method for uri [/%3Cfilebeat-7.13.2-%7Bnow/d%7D-000001%3E] and method [PUT], allowed: [POST]","status":405}: 405 Method Not Allowed: {"error":"Incorrect HTTP method for uri [/%3Cfilebeat-7.13.2-%7Bnow/d%7D-000001%3E] and method [PUT], allowed: [POST]","status":405}.

```

---

<div class="post-metadata">

### Author: ![PascalTurbo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pascalturbo/32/91244_2.png) [@PascalTurbo](https://discuss.elastic.co/u/PascalTurbo)
#### Post date: [July 8, 2021, 9:42am UTC](https://discuss.elastic.co/t/filebeat-incorrect-http-method-after-upgrade-to-7-13/277964/2 "2021-07-08T09:42:22Z")

</div>

Hey @all,

I've checked some documentation and try to debug the problem.  
As far as I can see, the request should be valid: [Rollover API | Elasticsearch Guide [7.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-rollover-index.html#roll-over-index-alias-with-write-index)

But ElasticSearch says, that the wrong method is called.  
Has anyone an idea, what went wrong here? Why does ElasticSearch behave different then in documentation?

Bests  
Pascal

---

<div class="post-metadata">

### Author: ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [July 9, 2021, 9:12am UTC](https://discuss.elastic.co/t/filebeat-incorrect-http-method-after-upgrade-to-7-13/277964/3 "2021-07-09T09:12:26Z")

</div>

Could you please share the config file? I'm not sure about entities `%3C`, `%3E` in `/%3Cfilebeat-7.13.2-%7Bnow/d%7D-000001%3E`.

---

<div class="post-metadata">

### Author: ![PascalTurbo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pascalturbo/32/91244_2.png) [@PascalTurbo](https://discuss.elastic.co/u/PascalTurbo)
#### Post date: [July 9, 2021, 11:52am UTC](https://discuss.elastic.co/t/filebeat-incorrect-http-method-after-upgrade-to-7-13/277964/4 "2021-07-09T11:52:07Z")

</div>

It's basicly the default-configuration of filebeat (Windows) with Module "IIS" enabled.

The requests looks like `https://my-elastic-host/<filebeat-7.13.2-{now/d}>/`. The response contains the escaped entities.

The only setting changed is

```auto
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["elasticsearch.my.url:443"]
  proxy_url: x.x.x.x:8080

  # Protocol - either `http` (default) or `https`.
  protocol: "https"

  username: xxx
  password: xxx

```

The proxy couldn't be the problem. I've send a PUT Request directly to the elasticsearch server.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 6, 2021, 1:52pm UTC](https://discuss.elastic.co/t/filebeat-incorrect-http-method-after-upgrade-to-7-13/277964/5 "2021-08-06T13:52:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
