Filebeat template with authentication

[tommy.walker (tommy)]

I have just stood up separate elastic, logstash and kibana servers. All running 6.2.
I have filebeats 6.2 running on windows 2016 server running iis v10. I have the iis logs successfully sending to logstash and i can see the logstash index in elasticsearch.
My problem is getting the filebeats template from my windows server to elasticsearch. When i run the following command :
.\filebeat.exe setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["10.200.0.210:9200"]'
I get the follwoing error message:
Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch http://10.200.0.210:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":
"security_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}}],"type":"security_exception","rea
son":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":"Basic realm="security" charset="UTF-8""}},"status":401}]

Im trying to figure out how to pass the user creds in the command but am not having any luck.

[tudor (Tudor Golubenco)]

It should be something like -E "output.elasticsearch.user=<username>"-E "output.elasticsearch.password=<password>". Or putting them in the URL should also work.

[tommy.walker (tommy)]

Thanks for your reply. I finally got it to work yesterday by modifying my filebeat.yml file as described in the documentation. Apparently, I was able to pass the creds via the .yml .