# What line indicates that filebeat is creating an index in Elasticsearch

**URL:** <https://discuss.elastic.co/t/what-line-indicates-that-filebeat-is-creating-an-index-in-elasticsearch/261791>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 21, 2021, 1:47pm UTC](https://discuss.elastic.co/t/what-line-indicates-that-filebeat-is-creating-an-index-in-elasticsearch/261791 "2021-01-21T13:47:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rajeshkp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajeshkp/32/82686_2.png) [@rajeshkp](https://discuss.elastic.co/u/rajeshkp)\
**Post date:** [January 21, 2021, 1:47pm UTC](https://discuss.elastic.co/t/what-line-indicates-that-filebeat-is-creating-an-index-in-elasticsearch/261791/1 "2021-01-21T13:47:18Z")

</div>

What line indicates that Filebeat 7.7.0 is creating an index in Elasticsearch. We are trying to debug the fact that its not creating an Elasticsearch index, but the harvester fails saying the index is missing. Isn't it the job of Filebeat to create this index when it starts, if so which lines in the logs `(obtained via kubectl logs <pod.id>)` indicate that it is getting created in the first place.

Error log shows this

```auto
Could not init registrar: registry file version 1 not supported

```

Environment: Filebeat DaemonSet running in Kubernetes cluster

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 24, 2021, 11:59pm UTC](https://discuss.elastic.co/t/what-line-indicates-that-filebeat-is-creating-an-index-in-elasticsearch/261791/2 "2021-01-24T23:59:30Z")

</div>

Welcome to our community! 😃

Can you share your Filebeat config and log?

---

<div class="post-metadata">

**Author:** ![rajeshkp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajeshkp/32/82686_2.png) [@rajeshkp](https://discuss.elastic.co/u/rajeshkp)\
**Post date:** [January 25, 2021, 4:34am UTC](https://discuss.elastic.co/t/what-line-indicates-that-filebeat-is-creating-an-index-in-elasticsearch/261791/3 "2021-01-25T04:34:09Z")

</div>

Its using this script [https://github.com/elastic/beats/blob/7.7/deploy/kubernetes/filebeat/filebeat-daemonset.yaml](https://github.com/elastic/beats/blob/7.7/deploy/kubernetes/filebeat/filebeat-daemonset.yaml) to run as a DaemonSet in a kubernetes environment. VERSION was set to 7.7.0  
[https://github.com/elastic/beats/blob/7.7/deploy/kubernetes/filebeat/filebeat-daemonset.yaml#L23](https://github.com/elastic/beats/blob/7.7/deploy/kubernetes/filebeat/filebeat-daemonset.yaml#L23) and the error log has the above failure information.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2021, 4:34am UTC](https://discuss.elastic.co/t/what-line-indicates-that-filebeat-is-creating-an-index-in-elasticsearch/261791/4 "2021-02-22T04:34:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.