# Filebeat setup (error loading template: failed to put data stream. no matching index template found for data stream)

**URL:** <https://discuss.elastic.co/t/filebeat-setup-error-loading-template-failed-to-put-data-stream-no-matching-index-template-found-for-data-stream/307789>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 21, 2022, 5:43pm UTC](https://discuss.elastic.co/t/filebeat-setup-error-loading-template-failed-to-put-data-stream-no-matching-index-template-found-for-data-stream/307789 "2022-06-21T17:43:07Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ulisses](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ulisses/32/107375_2.png) [@ulisses](https://discuss.elastic.co/u/ulisses)\
**Post date:** [June 21, 2022, 5:43pm UTC](https://discuss.elastic.co/t/filebeat-setup-error-loading-template-failed-to-put-data-stream-no-matching-index-template-found-for-data-stream/307789/1 "2022-06-21T17:43:07Z")

</div>

I'm running a dev environment to understand how i can use filebeat and elasticsearch to store our application logs but i can't make it work with custom configurations.

I'm trying to change index name following this documentation: [Change the index name | Filebeat Reference [8.2] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/change-index-name.html)

Result from **./filebeat setup** command:

```auto
Overwriting ILM policy is disabled. Set `setup.ilm.overwrite: true` for enabling.

Exiting: error loading template: failed to put data stream: could not put data stream: 400 Bad Request: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"no matching index template found for data stream [customname]"}],"type":"illegal_argument_exception","reason":"no matching index template found for data stream [customname]"},"status":400}. Response body: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"no matching index template found for data stream [customname]"}],"type":"illegal_argument_exception","reason":"no matching index template found for data stream [customname]"},"status":400}

```

My custom **filebeat.yml** :

```auto
setup.template:
  name: "customname"
  pattern: "customname-%{[agent.version]}"

filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - /a_path/app.log.json
  parsers:
    - ndjson:
        target: ""

output.elasticsearch:
  hosts: ["https://elastic-server:9200"]
  username: "elastic"
  password: "password"
  index: "customname-%{[agent.version]}"
  ssl:
    enabled: true
    ca_trusted_fingerprint: abigvalue

```

---

<div class="post-metadata">

**Author:** ![ulisses](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ulisses/32/107375_2.png) [@ulisses](https://discuss.elastic.co/u/ulisses)\
**Post date:** [June 22, 2022, 5:48pm UTC](https://discuss.elastic.co/t/filebeat-setup-error-loading-template-failed-to-put-data-stream-no-matching-index-template-found-for-data-stream/307789/2 "2022-06-22T17:48:23Z")

</div>

My solution was to create the Index Template manually on Kibana interface (cloning the default Index template generated by filebeat), since filebeat could not do it as expected and documented.

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [June 22, 2022, 5:50pm UTC](https://discuss.elastic.co/t/filebeat-setup-error-loading-template-failed-to-put-data-stream-no-matching-index-template-found-for-data-stream/307789/3 "2022-06-22T17:50:37Z")

</div>

Try

`pattern: "customname-%{[agent.version]}*"`

I think there was a change around 8.1.x that caused this.

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [June 22, 2022, 5:52pm UTC](https://discuss.elastic.co/t/filebeat-setup-error-loading-template-failed-to-put-data-stream-no-matching-index-template-found-for-data-stream/307789/4 "2022-06-22T17:52:29Z")

</div>

filebeat was probably trying to create a data stream, did you create a non data stream index? Not that it matters for usage.

---

<div class="post-metadata">

**Author:** ![ulisses](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ulisses/32/107375_2.png) [@ulisses](https://discuss.elastic.co/u/ulisses)\
**Post date:** [June 24, 2022, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-setup-error-loading-template-failed-to-put-data-stream-no-matching-index-template-found-for-data-stream/307789/6 "2022-06-24T15:15:47Z")

</div>

Did not work.

---

<div class="post-metadata">

**Author:** ![ulisses](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ulisses/32/107375_2.png) [@ulisses](https://discuss.elastic.co/u/ulisses)\
**Post date:** [June 24, 2022, 3:24pm UTC](https://discuss.elastic.co/t/filebeat-setup-error-loading-template-failed-to-put-data-stream-no-matching-index-template-found-for-data-stream/307789/7 "2022-06-24T15:24:31Z")

</div>

> filebeat was probably trying to create a data stream, did you create a non data stream index? Not that it matters for usage.

No. I did not.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2022, 5:24pm UTC](https://discuss.elastic.co/t/filebeat-setup-error-loading-template-failed-to-put-data-stream-no-matching-index-template-found-for-data-stream/307789/8 "2022-07-22T17:24:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.