Index Templates... where do they come from?

[eskorte (Sebastian)]

Hello!

I see three index templates filebeat-6.7.1, filebeat-7.0.0 and filebeat-7.0.1. Each with corresponding index patterns like filebeat-7.0.1- *.
Until now my logstash config was set to output.elasticsearch.index => filebeat-%{+yyyy.MM.dd} - so the templates did not match. Now I set the index to filebeat-%{[agent][version]}-%{+yyyy.MM.dd}. But now I use version 7.1.0 and new indexes are called like filebeat-7.1.0-2019.06.05. There is no template for this version. So my question is: where does these templates come from, and how do I get one for version 7.1.0?

Best regards,
Sebastian

[eskorte (Sebastian)]

Found it, filebeat setup:

# filebeat setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]' -E "output.elasticsearch.user=elastic" -E "output.elasticsearch.password=xxx"
Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch http://localhost:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [] for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"unable to authenticate user [] for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}]

I wonder why its "Unauthorized"...

[eskorte (Sebastian)]

Done. Workaround:

# filebeat export template > filebeat.template.json
# curl -XPUT -u "elastic:xxx" -H 'Content-Type: application/json' http://localhost:9200/_template/filebeat-7.1.0 -d@filebeat.template.json