# Need help in configuring filebeat 8.9 on windows server 2012 R2

**URL:** <https://discuss.elastic.co/t/need-help-in-configuring-filebeat-8-9-on-windows-server-2012-r2/339836>\
**Category:** Beats\
**Tags:** ilm-index-lifecycle-management, filebeat\
**Created:** [August 1, 2023, 4:36pm UTC](https://discuss.elastic.co/t/need-help-in-configuring-filebeat-8-9-on-windows-server-2012-r2/339836 "2023-08-01T16:36:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shan2](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@Shan2](https://discuss.elastic.co/u/Shan2)\
**Post date:** [August 1, 2023, 4:36pm UTC](https://discuss.elastic.co/t/need-help-in-configuring-filebeat-8-9-on-windows-server-2012-r2/339836/1 "2023-08-01T16:36:48Z")

</div>

Hi All,

First time implementing filebeat 8.9 on windows to pick files from Samba share and send it to Elasticsearch. The netwoek firewall rules has been allowed and telnet is also happening from windows server. We are getting below error while running the setup.

Overwriting ILM policy is disabled. Set `setup.ilm.overwrite: true` for enabling.

Exiting: failed to check for policy name 'filebeat': (status=401) {"Message":"Your request: '/\_ilm/policy/filebeat' is n  
ot allowed."}: 401 Unauthorized: {"Message":"Your request: '/\_ilm/policy/filebeat' is not allowed."}

Also we are unable to restart the filebeat services. Below is the configuration

filebeat.inputs:

- 
## type: filestream id: my-filestream-id enabled: true prospectors:
paths:
  - \samba share\logs\*.log

output.elasticsearch:  
bulk\_max\_size: 10  
hosts: ['awshost']  
ilm.enabled: auto  
indices:

- index: universe-logs-%{+yyyy}-w%{+ww}  
setup.ilm.enabled: false

Logging:  
json: true  
level: error  
to\_files: true  
files:  
path: \samba share\logs\*.log  
name: filebeat.log  
keepfiles: 7

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 29, 2023, 6:37pm UTC](https://discuss.elastic.co/t/need-help-in-configuring-filebeat-8-9-on-windows-server-2012-r2/339836/2 "2023-08-29T18:37:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.