Incorrect HTTP method for uri: 405 Method Not Allowed

Elastic Stack Beats
1

It appears ILM is creating an invalid uri for creating an alias. Here's part of a trace from tshark. Are the triangle brackets supposed to be there?

If not, how do I configure filebeat to work properly? I can't see anywhere to tell it to generate the correct uri.

  329 35.604452380    127.0.0.1 → 127.0.0.1    HTTP 764 PUT /<filebeat-7.17.23-{now/d}-000001> HTTP/1.0  (application/json)
  331 35.606396402    127.0.0.1 → 127.0.0.1    HTTP 341 HTTP/1.0 405 Method Not Allowed  (application/json)
  340 35.611672411    127.0.0.1 → 127.0.0.1    HTTP 630 GET /_alias/filebeat-7.17.23 HTTP/1.0 
  342 35.613715974    127.0.0.1 → 127.0.0.1    HTTP 568 HTTP/1.0 404 Not Found  (application/json)

filebeat.config:
  inputs:
    enabled: true
    path: ${path.config}/inputs.d/*.yml
    reload:
      enabled: true
      period: 10s
  modules:
    enabled: true
    path: ${path.config}/modules.d/*.yml
    reload:
      enabled: true
      period: 10s

# ================================== General ===================================

name: "hostname-blah.co.uk"

# ================================== Outputs ===================================

output.elasticsearch:
  enabled: true
  hosts: ["https://hostname-blah.co.uk:443"]

  compression_level: 0
  protocol: "https"

  username: "namehere"
  password: "pwhere"

  path: "/elasticsearch"

  ssl.enabled: true
  ssl.verification_mode: strict
  ssl.supported_protocols: [TLSv1.3]

# ================================== Logging ===================================

logging.to_files: true
logging.files:
  path: /var/log/filebeat

2024-11-17T15:15:25.496Z INFO [esclientleg] eslegclient/connection.go:285 Attempting to connect to Elasticsearch version 7.17.23

Overwriting ILM policy is disabled. Set setup.ilm.overwrite: true for enabling.

2024-11-17T15:15:25.534Z INFO [index-management] idxmgmt/std.go:260 Auto ILM enable success.

2024-11-17T15:15:25.542Z INFO [index-management.ilm] ilm/std.go:170 ILM policy filebeat exists already.

2024-11-17T15:15:25.542Z INFO [index-management] idxmgmt/std.go:396 Set setup.template.name to '{filebeat-7.17.23 {now/d}-000001}' as ILM is enabled.

2024-11-17T15:15:25.542Z INFO [index-management] idxmgmt/std.go:401 Set setup.template.pattern to 'filebeat-7.17.23-*' as ILM is enabled.

2024-11-17T15:15:25.542Z INFO [index-management] idxmgmt/std.go:435 Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.17.23 {now/d}-000001} as ILM is enabled.

2024-11-17T15:15:25.542Z INFO [index-management] idxmgmt/std.go:439 Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.

2024-11-17T15:15:25.562Z INFO template/load.go:197 Existing template will be overwritten, as overwrite is enabled.

2024-11-17T15:15:28.158Z INFO template/load.go:131 Try loading template filebeat-7.17.23 to Elasticsearch

2024-11-17T15:15:28.274Z INFO template/load.go:123 Template with name "filebeat-7.17.23" loaded.

2024-11-17T15:15:28.274Z INFO [index-management] idxmgmt/std.go:296 Loaded index template.

2024-11-17T15:15:28.313Z ERROR [index-management.ilm] ilm/std.go:133 Index Alias filebeat-7.17.23 setup failed: failed to create alias: {"error":"Incorrect HTTP method for uri [/<filebeat-7.17.23-{now/d}-000001>] and method [PUT], allowed: [POST]","status":405}: 405 Method Not Allowed: {"error":"Incorrect HTTP method for uri [/<filebeat-7.17.23-{now/d}-000001>] and method [PUT], allowed: [POST]","status":405}.

2024-11-17T15:15:28.314Z ERROR instance/beat.go:1027 Exiting: failed to create alias: {"error":"Incorrect HTTP method for uri [/<filebeat-7.17.23-{now/d}-000001>] and method [PUT], allowed: [POST]","status":405}: 405 Method Not Allowed: {"error":"Incorrect HTTP method for uri [/<filebeat-7.17.23-{now/d}-000001>] and method [PUT], allowed: [POST]","status":405}

Exiting: failed to create alias: {"error":"Incorrect HTTP method for uri [/<filebeat-7.17.23-{now/d}-000001>] and method [PUT], allowed: [POST]","status":405}: 405 Method Not Allowed: {"error":"Incorrect HTTP method for uri [/<filebeat-7.17.23-{now/d}-000001>] and method [PUT], allowed: [POST]","status":405}

2

So I've done some more verification of this issue and I'm very confused.

It appears filebeat is creating an invalid create alias request url:
HTTP 764 PUT /<filebeat-7.17.23-{now/d}-000001> HTTP/1.0 (application/json)

I have verified with tshark that it is not decoding the urlencoding, because the following works:
curl -XPUT 'http://localhost:9200/%3Cfilebeat-7.17.23-%7Bnow%2Fd%7D-000001%3E'

HTTP 187 PUT /%3Cfilebeat-7.17.23-%7Bnow%2Fd%7D-000001%3E HTTP/1.1 
HTTP 597 HTTP/1.1 200 OK  (application/json)

So I looked into the filebeat code to see if it is attempting to urlencode the CreateAlias request, and it is with url.PathEscape, but somehow this is failing to encode the url?

I'm very confused!

3

Also fails with version 7.17.25

4

This is a repository build problem, reported here:

Only affects filebeat version 7.x since 8.x does not use indexes and aliases: