# Kubernetes - Filebeat can't index event publisher

**URL:** https://discuss.elastic.co/t/kubernetes-filebeat-cant-index-event-publisher/164595
**Category:** Beats
**Tags:** filebeat
**Created:** [January 17, 2019, 9:04am UTC](https://discuss.elastic.co/t/kubernetes-filebeat-cant-index-event-publisher/164595 "2019-01-17T09:04:09Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![tomaaron](https://avatars.discourse-cdn.com/v4/letter/t/b5a626/32.png) [@tomaaron](https://discuss.elastic.co/u/tomaaron)
#### Post date: [January 17, 2019, 9:04am UTC](https://discuss.elastic.co/t/kubernetes-filebeat-cant-index-event-publisher/164595/1 "2019-01-17T09:04:10Z")

</div>

Hey there,

I am trying to setup Filebeat v6.5.4 on a selfhosted Kubernetes Cluster to monitor the PHP example guestbook application. I used the provided `filebeat-kubernetes.yaml` from your [GitHub Repo](https://github.com/elastic/examples/tree/master/MonitoringKubernetes). Metricbeat is already up and running and delivering metrics to our ELK Stack. Unfortunately I am getting this error on filebeat:

```auto
019-01-16T10:51:59.838Z WARN elasticsearch/client.go:521 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x0, ext:63683232711, loc:(*time.Location)(nil)}, Meta:common.MapStr{"pipeline":"filebeat-6.5.4-redis-slowlog-pipeline"}, Fields:common.MapStr{"fileset":common.MapStr{"module":"redis", "name":"slowlog"}, "input":common.MapStr{"type":"redis"}, "kubernetes":common.MapStr{"pod":common.MapStr{"name":"redis-master-655c796b5c-gmpxn"}, "node":common.MapStr{"name":"bd-test-gdbklnuv5lrm-minion-0"}, "container":common.MapStr{"name":"master"}, "namespace":"default", "replicaset":common.MapStr{"name":"redis-master-655c796b5c"}, "labels":common.MapStr{"app":"redis", "pod-template-hash":"2117352617", "role":"master", "tier":"backend"}}, "host":common.MapStr{"name":"filebeat-dynamic-wjtk4"}, "meta":common.MapStr{"cloud":common.MapStr{"provider":"openstack", "instance_id":"i-00002213", "machine_type":"n.2xlarge.50", "instance_name":"bd-test-gdbklnuv5lrm-minion-0", "availability_zone":"nova"}}, "message":"REPLCONF ACK 603317", "redis":common.MapStr{"slowlog":common.MapStr{"cmd":"REPLCONF", "key":"ACK", "duration":common.MapStr{"us":13}, "args":[]string{"603317"}, "id":38411}}, "read_timestamp":common.Time{wall:0x317e8e21, ext:63683232718, loc:(*time.Location)(nil)}, "prospector":common.MapStr{"type":"redis"}, "beat":common.MapStr{"name":"filebeat-dynamic-wjtk4", "hostname":"filebeat-dynamic-wjtk4", "version":"6.5.4"}}, Private:interface {}(nil)}, Flags:0x1} (status=404): {"type":"index_not_found_exception","reason":"no such index and [action.auto_create_index] ([.security,.monitoring*,.watches,.triggered_watches,.watcher-history*,logstash-*,metricbeat-*]) doesn't match","index_uuid":"_na_","index":"filebeat-6.5.4-2019.01.16"}

```

If you need any more information please let me know.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 14, 2019, 9:04am UTC](https://discuss.elastic.co/t/kubernetes-filebeat-cant-index-event-publisher/164595/2 "2019-02-14T09:04:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
