Filebeat receives HTTP 405 from Elasticsearch after 7.x -> 8.1 upgrade

Elastic Stack Beats
#1

Hi there,

since upgrading to v8.1 Filebeat no longer starts with the following error:

Connection marked as failed because the onConnect callback failed: error loading template: failure while checking if template exists: 405 Method Not Allowed

Currently, the flebeat_writer user is supposed to have the following roles:

  filebeat_writer:
    cluster:
      - manage_ilm
      - manage_index_templates
      - manage_ingest_pipelines
      - monitor
      - read_ilm
      - read_pipeline
    indices:
      - names:
          - filebeat
          - filebeat-*
        privileges:
          - create_index
          - manage
          - write

Which roles are missing?

#2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

#3

Hi @Specialist,

It seems there is a missing configuration in the template section from Filebeat.
I answered a very similar issue on GitHub, could you try the solution I posted there?

If it does not work for you, please post your Filebeat configuration and debug logs.