I'm having an issue getting a custom beat to load the template into elasticsearch.
Here is the section from my beat's config file:
setup.template.enabled: true
setup.template.name: "foobarbeat-%{[beat.version]}"
setup.template.pattern: "foobarbeat-%{[beat.version]}-*"
setup.template.json.enabled: true
setup.template.json.path: "${path.config}/foobarbeat.template.json"
setup.template.overwrite: true
Here's the beat's startup output:
2018-12-19T09:26:07.042-0700 INFO instance/beat.go:592 Home path: [/home/tlacuache/Desktop/foobarbeat] Config path: [/home/tlacuache/Desktop/foobarbeat] Data path: [/home/tlacuache/Desktop/foobarbeat/data] Logs path: [/home/tlacuache/Desktop/foobarbeat/logs]
2018-12-19T09:26:07.042-0700 INFO instance/beat.go:599 Beat UUID: cdd1ad88-e6e3-4af1-aec1-c815666efbfb
2018-12-19T09:26:07.043-0700 INFO [seccomp] seccomp/seccomp.go:116 Syscall filter successfully installed
2018-12-19T09:26:07.043-0700 INFO [beat] instance/beat.go:825 Beat info {"system_info": {"beat": {"path": {"config": "/home/tlacuache/Desktop/foobarbeat", "data": "/home/tlacuache/Desktop/foobarbeat/data", "home": "/home/tlacuache/Desktop/foobarbeat", "logs": "/home/tlacuache/Desktop/foobarbeat/logs"}, "type": "foobarbeat", "uuid": "cdd1ad88-e6e3-4af1-aec1-c815666efbfb"}}}
2018-12-19T09:26:07.043-0700 INFO [beat] instance/beat.go:834 Build info {"system_info": {"build": {"commit": "unknown", "libbeat": "6.5.3", "time": "1754-08-30T22:43:41.128Z", "version": "6.5.3"}}}
2018-12-19T09:26:07.043-0700 INFO [beat] instance/beat.go:837 Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":8,"version":"go1.10.5"}}}
2018-12-19T09:26:07.046-0700 INFO [beat] instance/beat.go:841 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2018-12-14T11:13:19-07:00","containerized":false,"name":"develhost","ip":["fe80::f027:40ff:fe3d:25bc/64","127.0.0.1/8","::1/128","fe80::8c54:c5ff:fe91:e8b0/64","172.16.10.162/24","fe80::9a90:96ff:fe9f:db13/64","172.17.0.1/16","fe80::42:2eff:fe84:1835/64","fe80::b09d:d8ff:fee0:1f2a/64","172.19.0.1/16","fe80::42:2aff:fedd:3d31/64","192.168.161.1/24","fe80::250:56ff:fec0:1/64","fe80::c44a:a0ff:fe1a:95cf/64","192.168.95.1/24","fe80::250:56ff:fec0:8/64","fe80::800f:74ff:fe95:9482/64","fe80::1c4a:aff:fe20:ed0/64","fe80::7865:1ff:fe7e:c075/64","fe80::5080:edff:feca:e315/64","fe80::602b:fdff:feca:8f77/64","192.168.32.1/20","fe80::42:93ff:fe8f:c90f/64"],"kernel_version":"4.18.0-3-amd64","mac":["f2:27:40:3d:25:bc","8e:54:c5:91:e8:b0","98:90:96:9f:db:13","02:42:2e:84:18:35","b2:9d:d8:e0:1f:2a","02:42:2a:dd:3d:31","00:50:56:c0:00:01","c6:4a:a0:1a:95:cf","00:50:56:c0:00:08","82:0f:74:95:94:82","1e:4a:0a:20:0e:d0","7a:65:01:7e:c0:75","52:80:ed:ca:e3:15","62:2b:fd:ca:8f:77","02:42:93:8f:c9:0f"],"os":{"family":"debian","platform":"debian","name":"Debian GNU/Linux","version":"","major":0,"minor":0,"patch":0},"timezone":"MST","timezone_offset_sec":-25200,"id":"a6e443eb17d74d9ba83b7b4b494107aa"}}}
2018-12-19T09:26:07.046-0700 INFO [beat] instance/beat.go:870 Process info {"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":null,"effective":null,"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read"],"ambient":null}, "cwd": "/home/tlacuache/Desktop/foobarbeat", "exe": "/home/tlacuache/Desktop/foobarbeat/foobarbeat", "name": "foobarbeat", "pid": 28479, "ppid": 28471, "seccomp": {"mode":"filter","no_new_privs":true}, "start_time": "2018-12-19T09:26:06.340-0700"}}}
2018-12-19T09:26:07.046-0700 INFO instance/beat.go:278 Setup Beat: foobarbeat; Version: 6.5.3
2018-12-19T09:26:07.046-0700 INFO elasticsearch/client.go:163 Elasticsearch url: https://localhost:9200
2018-12-19T09:26:07.047-0700 INFO [publisher] pipeline/module.go:110 Beat name: develhost
2018-12-19T09:26:07.047-0700 INFO instance/beat.go:400 foobarbeat start running.
2018-12-19T09:26:07.047-0700 INFO beater/foobarbeat.go:39 foobarbeat is running! Hit CTRL-C to stop it.
And here is the error when it tries to send an event:
2018-12-19T09:26:11.557-0700 INFO beater/foobarbeat.go:74 Event sent
2018-12-19T09:26:12.557-0700 INFO pipeline/output.go:95 Connecting to backoff(elasticsearch(https://localhost:9200))
2018-12-19T09:26:12.557-0700 WARN tlscommon/tls_config.go:79 SSL/TLS verifications disabled.
2018-12-19T09:26:12.591-0700 INFO elasticsearch/client.go:713 Connected to Elasticsearch version 6.5.3
2018-12-19T09:26:12.592-0700 INFO template/load.go:82 Loading template for Elasticsearch version: 6.5.3
2018-12-19T09:26:12.592-0700 INFO template/load.go:84 Existing template will be overwritten, as overwrite is enabled.
2018-12-19T09:26:12.593-0700 INFO template/load.go:94 Loading json template from file /home/tlacuache/Desktop/foobarbeat/foobarbeat.template.json
2018-12-19T09:26:13.594-0700 ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(https://localhost:9200)): Connection marked as failed because the onConnect callback failed: Error loading Elasticsearch template: could not load template. Elasticsearch returned: couldn't load template: couldn't load json. Error: 405 Method Not Allowed: {"error":"Incorrect HTTP method for uri [/_template/] and method [PUT], allowed: [GET]","status":405}. Response body: {"error":"Incorrect HTTP method for uri [/_template/] and method [PUT], allowed: [GET]","status":405}. Template is: [... cut out for length ...]
At first I thought I was having an issue with libbeat it builds with being a different version than elasticsearch but as you can see from the output they are both 6.5.3. Any ideas?
Thanks!