Ok, I just ran into the exact same issue when trying to set up heartbeat. When I run setup, and tail apache access logs, I see:
ip - r3elastic [02/Oct/2019:11:35:38 -0700] "PUT /_ilm/policy/heartbeat-7.4.0 HTTP/1.1" 200 210 "-" "Go-http-client/1.1"
ip - r3elastic [02/Oct/2019:11:35:38 -0700] "HEAD /_template/heartbeat-7.4.0 HTTP/1.1" 200 142 "-" "Go-http-client/1.1"
diff-ip - r3elastic [02/Oct/2019:11:35:38 -0700] "POST /_bulk HTTP/1.1" 200 612 "-" "Go-http-client/1.1"
ip - r3elastic [02/Oct/2019:11:35:38 -0700] "PUT /_template/heartbeat-7.4.0 HTTP/1.1" 200 210 "-" "Go-http-client/1.1"
ip - r3elastic [02/Oct/2019:11:35:38 -0700] "GET /_alias/heartbeat-7.4.0 HTTP/1.1" 404 252 "-" "Go-http-client/1.1"
So, why is /_alias/hearbeat-7.4.0 missing?
Curl also returns a 404.
# curl localhost:5601/_alias/heartbeat-7.4.0
{"statusCode":404,"error":"Not Found","message":"Not Found"}
And should that really matter? If I curl for filebeat or metricbeat, they 404 as well. But they still push data into elasticsearch.
# curl localhost:5601/_alias/journalbeat-7.4.0
{"statusCode":404,"error":"Not Found","message":"Not Found"}
# curl localhost:5601/_alias/metricbeat-7.4.0
{"statusCode":404,"error":"Not Found","message":"Not Found"}
# curl localhost:5601/_alias/filebeat-7.4.0
{"statusCode":404,"error":"Not Found","message":"Not Found"}