# How to disable xpack check in Filebeat
**URL:** https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997
**Category:** Beats
**Tags:** filebeat
**Created:** [August 25, 2018, 2:23am UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997 "2018-08-25T02:23:37Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@xiaowangwindow](https://discuss.elastic.co/u/xiaowangwindow)
#### Post date: [August 25, 2018, 2:23am UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/1 "2018-08-25T02:23:37Z")
hello, I am a newbie to use ES and Kibana in Amazon Elasticsearch Service, which do not support xpack plugin.
I use Filebeat to send nginx log to ES directly. However, when run `sudo filebeat setup -e`, error happen like below:
```auto
ERROR instance/beat.go:691 Exiting: 2 errors: Error checking if xpack is available: 401 Unauthorized: {"Message":"Your request: '/_xpack' is not allowed."}; Error checking if xpack is available: 401 Unauthorized: {"Message":"Your request: '/_xpack' is not allowed."}
```
the error happened because elasticsearch in Amazzon Elasticsearch Service don't support xpack plugin, and user can't install manually.
So, I add below config to `/etc/filebeat/filebeat.yml` in order to disable xpack and forbidden filebeat to check xpack availability. But the error still exists.
```auto
xpack.security.enabled: false
xpack.monitoring.enabled: false
xpack.graph.enabled: false
xpack.watcher.enabled: false
xpack.reporting.enabled: false
```
Is there any way to disable filebeat xpack check?
Environments:
Filebeat: 6.4.0
Elasticsearch: 6.3 in Amazon ElasticSearch Service
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 27, 2018, 12:39am UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/2 "2018-08-27T00:39:44Z")
You have two options;
1. Upgrade to [Elastic Cloud](https://www.elastic.co/cloud/elasticsearch-service) and get access to all the X-Pack functionality included
2. Use [https://www.elastic.co/downloads/beats/filebeat-oss](https://www.elastic.co/downloads/beats/filebeat-oss)
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [August 27, 2018, 2:01pm UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/3 "2018-08-27T14:01:15Z")
Can you share your complete filebeat.yml config file?
According to [the docs](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-monitor.html#configuration-monitor) the setting to disable monitoring is `xpack.monitoring.enabled: false`. The default value is `false`.
---
### Author:  [@xiaowangwindow](https://discuss.elastic.co/u/xiaowangwindow)
#### Post date: [August 27, 2018, 2:21pm UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/4 "2018-08-27T14:21:25Z")
I installed the latest filebeat-sso, the error still exsit.
```auto
Error checking if xpack is available: 401 Unauthorized: {"Message":"Your request: '/_xpack' is not allowed."};
```
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [August 27, 2018, 3:29pm UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/5 "2018-08-27T15:29:34Z")
Can you share your complete filebeat.yml config file?
---
### Author:  [@xiaowangwindow](https://discuss.elastic.co/u/xiaowangwindow)
#### Post date: [August 27, 2018, 3:50pm UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/6 "2018-08-27T15:50:29Z")
this is my filebeat.yml
```auto
#=========================== Filebeat inputs =============================
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
# Change to true to enable this input configuration.
enabled: false
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /var/log/*.log
#- c:\programdata\elasticsearch\logs\*
filebeat.config.modules:
# Glob pattern for configuration loading
path: ${path.config}/modules.d/*.yml
# Set to true to enable config reloading
reload.enabled: false
#==================== Elasticsearch template setting ==========================
setup.template.settings:
index.number_of_shards: 3
#index.codec: best_compression
#_source.enabled: false
setup.kibana:
host: "https://search-server-log-MY-AMAZON-ID.us-west-1.es.amazonaws.com:443/_plugin/kibana/"
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["https://search-server-log-MY-AMAZON-ID.us-west-1.es.amazonaws.com:443"]
xpack.security.enabled: false
xpack.monitoring.enabled: false
xpack.graph.enabled: false
xpack.watcher.enabled: false
xpack.reporting.enabled: false
```
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [August 27, 2018, 5:35pm UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/7 "2018-08-27T17:35:34Z")
These settings do not exist in beats:
```auto
xpack.security.enabled: false
xpack.graph.enabled: false
xpack.watcher.enabled: false
xpack.reporting.enabled: false
```
The problem is `setup` tries to install ML modules. Normally Elasticsearch gets us an error message telling us ML is not available and beats continue with setup phase. The Amazon Elasticsearch Service is not by us, we don't test against it and we can not guarantee compatibility.
You can try to run setup only with functionality you want to enable. This will setup dashboards, ingest node pipelines and the index templates:
`$ sudo filebeat setup -e --dashboards --pipelines --template`
---
### Author:  [@sentient](https://discuss.elastic.co/u/sentient)
#### Post date: [August 31, 2018, 3:13am UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/8 "2018-08-31T03:13:32Z")
Thanks steffens. This helped.
Facing the next issue on ingest-geoip. No access to AWS elasticsearch to install a plugin. (or I don't know if that is possible)
````auto
2018-08-31T03:08:18.312Z INFO elasticsearch/client.go:690 Connected to Elasticsearch version 6.3.1
2018-08-31T03:08:18.437Z INFO fileset/pipelines.go:62 Elasticsearch pipeline with ID 'filebeat-6.3.1-system-syslog-pipeline' loaded
2018-08-31T03:08:18.471Z ERROR instance/beat.go:691 Exiting: Error loading pipeline for fileset system/auth: This module requires the ingest-geoip plugin to be installed in Elasticsearch. You can install it using the following command in the Elasticsearch home directory:
sudo bin/elasticsearch-plugin install ingest-geoip
Exiting: Error loading pipeline for fileset system/auth: This module requires the ingest-geoip plugin to be installed in Elasticsearch. You can install it using the following command in the Elasticsearch home directory:
sudo bin/elasticsearch-plugin install ingest-geoip
```
````
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 31, 2018, 3:17am UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/9 "2018-08-31T03:17:05Z")
> [@sentient](#):
>
> No access to AWS elasticsearch to install a plugin
It's not.
---
### Author:  [@sentient](https://discuss.elastic.co/u/sentient)
#### Post date: [August 31, 2018, 3:33am UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/10 "2018-08-31T03:33:58Z")
I found a post what worked for me
1. Stop the filebeat service
2. delete existing pipeline
3. start the filebeat service
4. Log
```auto
instance# systemctl stop filebeat.service
instance# curl -XDELETE "https://vpc-:443/_ingest/pipeline/filebeat-*"
instance# systemctl restart filebeat.service
```
---
### Author:  [@sentient](https://discuss.elastic.co/u/sentient)
#### Post date: [August 31, 2018, 3:35am UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/11 "2018-08-31T03:35:54Z")
@warkolm thanks for the reply. But I don't fully understand what you mean with "It's not"
You mean: I can install plugins.
or
"that is not the problem"
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 31, 2018, 3:36am UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/12 "2018-08-31T03:36:22Z")
You cannot install plugins on the AWS service.
You should upgrade to Elastic Cloud.
---
### Author:  [@sentient](https://discuss.elastic.co/u/sentient)
#### Post date: [August 31, 2018, 3:37am UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/13 "2018-08-31T03:37:58Z")
I would love to. However I must have the data installed within my VPC for security reasons.
It was my understanding that Elastic Cloud currently does not offer to host the solution on my own VPC
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 28, 2018, 3:37am UTC](https://discuss.elastic.co/t/how-to-disable-xpack-check-in-filebeat/145997/14 "2018-09-28T03:37:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.