# Filebeat to AWS ES \_xpack
**URL:** https://discuss.elastic.co/t/filebeat-to-aws-es-xpack/236913
**Category:** Beats
**Tags:** filebeat
**Created:** [June 12, 2020, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-to-aws-es-xpack/236913 "2020-06-12T14:45:34Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Jonny\_McCullagh](https://discuss.elastic.co/u/Jonny_McCullagh)
#### Post date: [June 12, 2020, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-to-aws-es-xpack/236913/1 "2020-06-12T14:45:34Z")
I appreciate that ES does not support the AWS implementation, so let me know if this question would be better on stackoverflow.
When running filebeat setup I get:
`Exiting: request checking for ILM availability failed: 401 Unauthorized: {"Message":"Your request: '/_xpack' is not allowed."}`
I've installed the OSS version of filebeat, version info is:
`filebeat version 7.7.1 (amd64), libbeat 7.7.1 [932b273e8940575e15f10390882be205bad29e1f built 2020-05-28 14:53:26 +0000 UTC]`
In my filebeat.yml I have :
monitoring.enabled: false
xpack.security.enabled: false
xpack.monitoring.enabled: false
I've tried
`filebeat setup --pipelines -c /etc/filebeat/filebeat.yml`
And then run the filebeat service but the debug logs still show the \_xpack error message.
---
### Author:  [@Jonny\_McCullagh](https://discuss.elastic.co/u/Jonny_McCullagh)
#### Post date: [June 12, 2020, 2:58pm UTC](https://discuss.elastic.co/t/filebeat-to-aws-es-xpack/236913/2 "2020-06-12T14:58:23Z")
omg I think I got it. My filebeat.yml needed the following line:
`setup.ilm.enabled: false`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 10, 2020, 4:58pm UTC](https://discuss.elastic.co/t/filebeat-to-aws-es-xpack/236913/3 "2020-07-10T16:58:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.