# Incorrect HTTP method for uri: 405 Method Not Allowed

**URL:** https://discuss.elastic.co/t/incorrect-http-method-for-uri-405-method-not-allowed/370661
**Category:** Beats
**Tags:** filebeat
**Created:** [November 17, 2024, 3:22pm UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri-405-method-not-allowed/370661 "2024-11-17T15:22:05Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![racitup](https://avatars.discourse-cdn.com/v4/letter/r/c37758/32.png) [@racitup](https://discuss.elastic.co/u/racitup)
#### Post date: [November 17, 2024, 3:22pm UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri-405-method-not-allowed/370661/1 "2024-11-17T15:22:05Z")

</div>

It appears ILM is creating an invalid uri for creating an alias. Here's part of a trace from tshark. Are the triangle brackets supposed to be there?

If not, how do I configure filebeat to work properly? I can't see anywhere to tell it to generate the correct uri.

```auto
  329 35.604452380 127.0.0.1 → 127.0.0.1 HTTP 764 PUT /<filebeat-7.17.23-{now/d}-000001> HTTP/1.0 (application/json)
  331 35.606396402 127.0.0.1 → 127.0.0.1 HTTP 341 HTTP/1.0 405 Method Not Allowed (application/json)
  340 35.611672411 127.0.0.1 → 127.0.0.1 HTTP 630 GET /_alias/filebeat-7.17.23 HTTP/1.0 
  342 35.613715974 127.0.0.1 → 127.0.0.1 HTTP 568 HTTP/1.0 404 Not Found (application/json)

```

```auto
filebeat.config:
  inputs:
    enabled: true
    path: ${path.config}/inputs.d/*.yml
    reload:
      enabled: true
      period: 10s
  modules:
    enabled: true
    path: ${path.config}/modules.d/*.yml
    reload:
      enabled: true
      period: 10s

# ================================== General ===================================

name: "hostname-blah.co.uk"

# ================================== Outputs ===================================

output.elasticsearch:
  enabled: true
  hosts: ["https://hostname-blah.co.uk:443"]

  compression_level: 0
  protocol: "https"

  username: "namehere"
  password: "pwhere"

  path: "/elasticsearch"

  ssl.enabled: true
  ssl.verification_mode: strict
  ssl.supported_protocols: [TLSv1.3]

# ================================== Logging ===================================

logging.to_files: true
logging.files:
  path: /var/log/filebeat

```

> 2024-11-17T15:15:25.496Z INFO [esclientleg] eslegclient/connection.go:285 Attempting to connect to Elasticsearch version 7.17.23
> 
> Overwriting ILM policy is disabled. Set `setup.ilm.overwrite: true` for enabling.
> 
> 2024-11-17T15:15:25.534Z INFO [index-management] idxmgmt/std.go:260 Auto ILM enable success.
> 
> 2024-11-17T15:15:25.542Z INFO [index-management.ilm] ilm/std.go:170 ILM policy filebeat exists already.
> 
> 2024-11-17T15:15:25.542Z INFO [index-management] idxmgmt/std.go:396 Set setup.template.name to '{filebeat-7.17.23 {now/d}-000001}' as ILM is enabled.
> 
> 2024-11-17T15:15:25.542Z INFO [index-management] idxmgmt/std.go:401 Set setup.template.pattern to 'filebeat-7.17.23-\*' as ILM is enabled.
> 
> 2024-11-17T15:15:25.542Z INFO [index-management] idxmgmt/std.go:435 Set settings.index.lifecycle.rollover\_alias in template to {filebeat-7.17.23 {now/d}-000001} as ILM is enabled.
> 
> 2024-11-17T15:15:25.542Z INFO [index-management] idxmgmt/std.go:439 Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max\_age":"30d","max\_size":"50gb"}}}}}}} as ILM is enabled.
> 
> 2024-11-17T15:15:25.562Z INFO template/load.go:197 Existing template will be overwritten, as overwrite is enabled.
> 
> 2024-11-17T15:15:28.158Z INFO template/load.go:131 Try loading template filebeat-7.17.23 to Elasticsearch
> 
> 2024-11-17T15:15:28.274Z INFO template/load.go:123 Template with name "filebeat-7.17.23" loaded.
> 
> 2024-11-17T15:15:28.274Z INFO [index-management] idxmgmt/std.go:296 Loaded index template.
> 
> 2024-11-17T15:15:28.313Z ERROR [index-management.ilm] ilm/std.go:133 Index Alias filebeat-7.17.23 setup failed: failed to create alias: {"error":"Incorrect HTTP method for uri [/\<filebeat-7.17.23-{now/d}-000001\>] and method [PUT], allowed: [POST]","status":405}: 405 Method Not Allowed: {"error":"Incorrect HTTP method for uri [/\<filebeat-7.17.23-{now/d}-000001\>] and method [PUT], allowed: [POST]","status":405}.
> 
> 2024-11-17T15:15:28.314Z ERROR instance/beat.go:1027 Exiting: failed to create alias: {"error":"Incorrect HTTP method for uri [/\<filebeat-7.17.23-{now/d}-000001\>] and method [PUT], allowed: [POST]","status":405}: 405 Method Not Allowed: {"error":"Incorrect HTTP method for uri [/\<filebeat-7.17.23-{now/d}-000001\>] and method [PUT], allowed: [POST]","status":405}
> 
> Exiting: failed to create alias: {"error":"Incorrect HTTP method for uri [/\<filebeat-7.17.23-{now/d}-000001\>] and method [PUT], allowed: [POST]","status":405}: 405 Method Not Allowed: {"error":"Incorrect HTTP method for uri [/\<filebeat-7.17.23-{now/d}-000001\>] and method [PUT], allowed: [POST]","status":405}

---

<div class="post-metadata">

### Author: ![racitup](https://avatars.discourse-cdn.com/v4/letter/r/c37758/32.png) [@racitup](https://discuss.elastic.co/u/racitup)
#### Post date: [November 19, 2024, 2:15pm UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri-405-method-not-allowed/370661/2 "2024-11-19T14:15:59Z")

</div>

So I've done some more verification of this issue and I'm very confused.

It appears filebeat is creating an invalid create alias request url:  
`HTTP 764 PUT /<filebeat-7.17.23-{now/d}-000001> HTTP/1.0 (application/json)`

I have verified with tshark that it is not decoding the urlencoding, because the following works:  
`curl -XPUT 'http://localhost:9200/%3Cfilebeat-7.17.23-%7Bnow%2Fd%7D-000001%3E'`

```auto
HTTP 187 PUT /%3Cfilebeat-7.17.23-%7Bnow%2Fd%7D-000001%3E HTTP/1.1 
HTTP 597 HTTP/1.1 200 OK (application/json)

```

So I looked into the filebeat code to see if it is attempting to urlencode the CreateAlias request, and it is with `url.PathEscape`, but somehow this is failing to encode the url?

I'm very confused!

> <https://github.com/elastic/beats/blob/bd0ffc1af3bb6c6b0b61e4324f8d9e905b60b45a/libbeat/idxmgmt/ilm/client_handler.go#L178-L194>

---

<div class="post-metadata">

### Author: ![racitup](https://avatars.discourse-cdn.com/v4/letter/r/c37758/32.png) [@racitup](https://discuss.elastic.co/u/racitup)
#### Post date: [November 19, 2024, 3:46pm UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri-405-method-not-allowed/370661/3 "2024-11-19T15:46:02Z")

</div>

Also fails with version 7.17.25

---

<div class="post-metadata">

### Author: ![racitup](https://avatars.discourse-cdn.com/v4/letter/r/c37758/32.png) [@racitup](https://discuss.elastic.co/u/racitup)
#### Post date: [November 19, 2024, 4:09pm UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri-405-method-not-allowed/370661/4 "2024-11-19T16:09:17Z")

</div>

This is a repository build problem, reported here:

> <https://github.com/elastic/beats/issues/41686>
>
> It appears standard filebeat create alias functionality is causing:
> \`{"error":"I…ncorrect HTTP method for uri \[/\<filebeat-7.17.23-{now/d}-000001\>\] and method \[PUT\], allowed: \[POST\]","status":405}\`
> 
> 
> It appears the url.PathEscape in the following code is failing somehow:
> https://github.com/elastic/beats/blob/bd0ffc1af3bb6c6b0b61e4324f8d9e905b60b45a/libbeat/idxmgmt/ilm/client\_handler.go#L178-L194
> 
> I've raised a forum issue here but had no luck so far:
> https://discuss.elastic.co/t/incorrect-http-method-for-uri-405-method-not-allowed/370661
> 
> Same error on 7.17.25

Only affects filebeat version 7.x since 8.x does not use indexes and aliases:

> **[Breaking changes in 8.0 | Beats Platform Reference \[8.16\] | Elastic](https://www.elastic.co/guide/en/beats/libbeat/8.16/breaking-changes-8.0.html)**