# \[HELP\]\[ERROR\]\[FILEBEAT\] “cannot retrieve the elasticsearch license from the /\_license endpoint”

**URL:** <https://discuss.elastic.co/t/help-error-filebeat-cannot-retrieve-the-elasticsearch-license-from-the-license-endpoint/239123>\
**Category:** Elasticsearch\
**Created:** [June 29, 2020, 2:15pm UTC](https://discuss.elastic.co/t/help-error-filebeat-cannot-retrieve-the-elasticsearch-license-from-the-license-endpoint/239123 "2020-06-29T14:15:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vikas\_Rathore](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_rathore/32/70471_2.png) [@Vikas\_Rathore](https://discuss.elastic.co/u/Vikas_Rathore)\
**Post date:** [June 29, 2020, 2:15pm UTC](https://discuss.elastic.co/t/help-error-filebeat-cannot-retrieve-the-elasticsearch-license-from-the-license-endpoint/239123/1 "2020-06-29T14:15:46Z")

</div>

I had below filebeat-kubernetes.yaml for my ELK where I was using filebeat v 6.6.2 and AWS Elasticsearch version 6.4. Everything was working fine.

```
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-system
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.inputs:
    - type: container
      paths:
        - /var/log/containers/*.log
      processors:
        - add_kubernetes_metadata:
            host: ${NODE_NAME}
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"

    # To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this:
    #filebeat.autodiscover:
    # providers:
    # - type: kubernetes
    # node: ${NODE_NAME}
    # hints.enabled: true
    # hints.default_config:
    # type: container
    # paths:
    # - /var/log/containers/*${data.kubernetes.container.id}.log

    processors:
      - add_cloud_metadata:
      - add_host_metadata:

    output.elasticsearch:
      hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-inputs
  namespace: kube-system
  labels:
    k8s-app: filebeat
data:
  kubernetes.yml: |-
    - type: docker
      containers.ids:
      - "*"
      processors:
        - add_kubernetes_metadata:
            in_cluster: true
      fields:
        aws_account_id: ${aws_account_id} 
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: filebeat
  namespace: kube-system
  labels:
    k8s-app: filebeat
spec:
  selector:
    matchLabels:
      k8s-app: filebeat
  template:
    metadata:
      labels:
        k8s-app: filebeat
    spec:
      serviceAccountName: filebeat
      terminationGracePeriodSeconds: 30
      containers:
      - name: filebeat
        image: docker.elastic.co/beats/filebeat:7.8.0
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        env:
        - name: ELASTICSEARCH_HOST
          value: ${elasticsearch_host}
        - name: ELASTICSEARCH_PORT
          value: "443"
        securityContext:
          runAsUser: 0
        resources:
          limits:
            memory: 256Mi
          requests:
            cpu: 100m
            memory: 100Mi
        volumeMounts:
        - name: config
          mountPath: /etc/filebeat.yml
          readOnly: true
          subPath: filebeat.yml
        - name: inputs
          mountPath: /usr/share/filebeat/inputs.d
          readOnly: true
        - name: data
          mountPath: /usr/share/filebeat/data
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
      volumes:
      - name: config
        configMap:
          defaultMode: 0600
          name: filebeat-config
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
      - name: inputs
        configMap:
          defaultMode: 0600
          name: filebeat-inputs
      # We set an `emptyDir` here to ensure the manifest will deploy correctly.
      # It's recommended to change this to a `hostPath` folder, to ensure internal data
      # files survive pod changes (ie: version upgrade)
      - name: data
        emptyDir: {}
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: filebeat
subjects:
- kind: ServiceAccount
  name: filebeat
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: filebeat
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: filebeat
  labels:
    k8s-app: filebeat
rules:
- apiGroups: [""] # "" indicates the core API group
  resources:
  - namespaces
  - pods
  verbs:
  - get
  - watch
  - list
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: filebeat
  namespace: kube-system
  labels:
    k8s-app: filebeat
---

```

But when I am trying to update the version to 7.8.0(also updated the AWS elastic search to 7.4). I started getting an error

`Connection marked as failed because the onConnect callback failed: cannot retrieve the elasticsearch license from the /_license endpoint, Filebeat requires the default distribution of Elasticsearch. Please make the endpoint accessible to Filebeat so it can verify the license.: unauthorized access, could not connect to the xpack endpoint, verify your credentials`

Someone suggested me to use the latest filebeat-kubernetes.yaml file. [https://raw.githubusercontent.com/elastic/beats/7.8/deploy/kubernetes/filebeat-kubernetes.yaml](https://raw.githubusercontent.com/elastic/beats/7.8/deploy/kubernetes/filebeat-kubernetes.yaml)

But I have trouble using it. Didn't find any documentation as well.

1. How can I get ELASTICSEARCH\_USERNAME, ELASTICSEARCH\_PASSWORD, ELASTIC\_CLOUD\_ID, ELASTIC\_CLOUD\_AUTH? As in AWS I am not getting any username and password.
2. On older yaml. I am passing " aws\_account\_id: ${aws\_account\_id} " in kubernetes.yaml. But I don't see any option in the new format yaml.

Can someone please help me to understand

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 29, 2020, 3:17pm UTC](https://discuss.elastic.co/t/help-error-filebeat-cannot-retrieve-the-elasticsearch-license-from-the-license-endpoint/239123/2 "2020-06-29T15:17:13Z")

</div>

You need to use the OSS distribution and not the default one if connecting to AWS ES I believe.

Have not used AWS ES so am not sure how you need to configure to connect.

---

<div class="post-metadata">

**Author:** ![Vikas\_Rathore](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_rathore/32/70471_2.png) [@Vikas\_Rathore](https://discuss.elastic.co/u/Vikas_Rathore)\
**Post date:** [June 29, 2020, 3:22pm UTC](https://discuss.elastic.co/t/help-error-filebeat-cannot-retrieve-the-elasticsearch-license-from-the-license-endpoint/239123/3 "2020-06-29T15:22:11Z")

</div>

Yes I am using AWS ES. OSS distribution? Could you please provide me a link or any documentation. From where I can get this info. I am applying this way, using kubeconfig

kubectl apply -f .filebeat-kubernetes.yaml --kubeconfig .kube\_config.yaml

Thanks for helping

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 29, 2020, 3:30pm UTC](https://discuss.elastic.co/t/help-error-filebeat-cannot-retrieve-the-elasticsearch-license-from-the-license-endpoint/239123/4 "2020-06-29T15:30:05Z")

</div>

Use the OSS distribution of Filebeat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2020, 3:30pm UTC](https://discuss.elastic.co/t/help-error-filebeat-cannot-retrieve-the-elasticsearch-license-from-the-license-endpoint/239123/5 "2020-07-27T15:30:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.