# Logstash error trying to index filebeat

**URL:** <https://discuss.elastic.co/t/logstash-error-trying-to-index-filebeat/255175>\
**Category:** Logstash\
**Created:** [November 12, 2020, 9:13am UTC](https://discuss.elastic.co/t/logstash-error-trying-to-index-filebeat/255175 "2020-11-12T09:13:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Craig2188](https://avatars.discourse-cdn.com/v4/letter/c/858c86/32.png) [@Craig2188](https://discuss.elastic.co/u/Craig2188)\
**Post date:** [November 12, 2020, 9:13am UTC](https://discuss.elastic.co/t/logstash-error-trying-to-index-filebeat/255175/1 "2020-11-12T09:13:08Z")

</div>

Hi,

Logstash log files are being filled up with indexing errors for filebeat:

`[2020-11-12T09:06:02,844][WARN][logstash.outputs.elasticsearch][main][28a01e4629fbbc3006822900269029f08bd4f371d6be029377ac4944518e3137] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-2020.11.12", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x19dc9f8>], :response=>{"index"=>{"_index"=>"filebeat-2020.11.12", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"only write ops with an op_type of create are allowed in data streams"}}}}`

Any thoughts as to what is causing this? I can't see that it is related to setting up TLS/HTTPS connections for Kibana/Elastic/Logstash

---

<div class="post-metadata">

**Author:** ![Craig2188](https://avatars.discourse-cdn.com/v4/letter/c/858c86/32.png) [@Craig2188](https://discuss.elastic.co/u/Craig2188)\
**Post date:** [November 12, 2020, 9:32am UTC](https://discuss.elastic.co/t/logstash-error-trying-to-index-filebeat/255175/2 "2020-11-12T09:32:18Z")

</div>

Got it sorted after removing all of the xpack options in the YML file

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 10, 2020, 9:32am UTC](https://discuss.elastic.co/t/logstash-error-trying-to-index-filebeat/255175/3 "2020-12-10T09:32:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.