Error when configuring Filebeat: "failure while checking if template exists: 405 Method Not Allowed"

Question

I'm trying to set up Filebeat to work with Kibana. On Ubuntu, everything works without problems, but on Windows Server 2019, when I try to run the configuration, an error pops up.

I can't figure out what the problem is.

ERROR   instance/beat.go:1015   Exiting: error loading template: failure while checking if template exists: 405 Method Not Allowed:

Full log:

PS C:\Program Files\Filebeat> .\filebeat.exe setup -e
2022-03-31T13:21:25.719+0300    INFO    instance/beat.go:686    Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\Program Files\Filebeat\data] Logs path: [C:\Program Files\Filebeat\logs] Hostfs Path: [/]
2022-03-31T13:21:25.719+0300    INFO    instance/beat.go:694    Beat ID: 94b14bfc-bd57-4d05-9103-53c0a8740d1d
2022-03-31T13:21:28.730+0300    WARN    [add_cloud_metadata]    add_cloud_metadata/provider_aws_ec2.go:79       read token request for getting IMDSv2 token returns empty: Put "http://169.254.169.254/latest/api/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers). No token in the metadata request will be used.
2022-03-31T13:21:28.730+0300    INFO    [beat]  instance/beat.go:1040   Beat info       {"system_info": {"beat": {"path": {"config": "C:\\Program Files\\Filebeat", "data": "C:\\Program Files\\Filebeat\\data", "home": "C:\\Program Files\\Filebeat", "logs": "C:\\Program Files\\Filebeat\\logs"}, "type": "filebeat", "uuid": "94b14bfc-bd57-4d05-9103-53c0a8740d1d"}}}
2022-03-31T13:21:28.730+0300    INFO    [beat]  instance/beat.go:1049   Build info      {"system_info": {"build": {"commit": "3c518f4d17a15dc85bdd68a5a03d5af51d9edd8e", "libbeat": "7.16.2", "time": "2021-12-18T21:04:19.000Z", "version": "7.16.2"}}}
2022-03-31T13:21:28.730+0300    INFO    [beat]  instance/beat.go:1052   Go runtime info {"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":8,"version":"go1.17.5"}}}
2022-03-31T13:21:28.730+0300    INFO    [beat]  instance/beat.go:1056   Host info       {"system_info": {"host": {"architecture":"x86_64","boot_time":"2022-03-29T00:15:54.96+03:00","name":"ep-wa-1-vcto-1","ip":["10.102.6.170/24","::1/128","127.0.0.1/8"],"kernel_version":"10.0.17763.1697 (WinBuild.160101.0800)","mac":["00:50:56:a8:02:a5"],"os":{"type":"windows","family":"windows","platform":"windows","name":"Windows Server 2019 Datacenter","version":"10.0","major":10,"minor":0,"patch":0,"build":"17763.1697"},"timezone":"MSK","timezone_offset_sec":10800,"id":"4ffa394f-56e5-4e95-85b8-58141f331552"}}}
2022-03-31T13:21:28.730+0300    INFO    [beat]  instance/beat.go:1085   Process info    {"system_info": {"process": {"cwd": "C:\\Program Files\\Filebeat", "exe": "C:\\Program Files\\Filebeat\\filebeat.exe", "name": "filebeat.exe", "pid": 10924, "ppid": 9296, "start_time": "2022-03-31T13:21:25.598+0300"}}}
2022-03-31T13:21:28.740+0300    INFO    instance/beat.go:328    Setup Beat: filebeat; Version: 7.16.2
2022-03-31T13:21:28.740+0300    INFO    [index-management]      idxmgmt/std.go:184      Set output.elasticsearch.index to 'filebeat-7.16.2' as ILM is enabled.
2022-03-31T13:21:28.740+0300    INFO    [esclientleg]   eslegclient/connection.go:102   elasticsearch url: http://Elastic-ip:9200
2022-03-31T13:21:28.740+0300    INFO    [publisher]     pipeline/module.go:113  Beat name: ep-wa-1-vcto-1
2022-03-31T13:21:28.740+0300    INFO    [esclientleg]   eslegclient/connection.go:102   elasticsearch url: http://Elastic-ip:9200
2022-03-31T13:21:28.740+0300    INFO    [esclientleg]   eslegclient/connection.go:282   Attempting to connect to Elasticsearch version 7.6.2
2022-03-31T13:21:28.762+0300    INFO    [index-management]      idxmgmt/std.go:261      Auto ILM enable success.
2022-03-31T13:21:28.852+0300    INFO    [index-management.ilm]  ilm/std.go:180  ILM policy filebeat successfully created.
2022-03-31T13:21:28.852+0300    INFO    [index-management]      idxmgmt/std.go:397      Set setup.template.name to '{filebeat-7.16.2 {now/d}-000001}' as ILM is enabled.
2022-03-31T13:21:28.856+0300    INFO    [index-management]      idxmgmt/std.go:402      Set setup.template.pattern to 'filebeat-7.16.2-*' as ILM is enabled.
2022-03-31T13:21:28.857+0300    INFO    [index-management]      idxmgmt/std.go:436      Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.16.2 {now/d}-000001} as ILM is enabled.
2022-03-31T13:21:28.857+0300    INFO    [index-management]      idxmgmt/std.go:440      Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2022-03-31T13:21:28.858+0300    ERROR   instance/beat.go:1015   Exiting: error loading template: failure while checking if template exists: 405 Method Not Allowed:

filebeat.yml:

# ============================== Filebeat inputs ===============================

filebeat.inputs:

- type: filestream
  enabled: false
  paths:
    - /var/log/*.log

# ============================== Filebeat modules ==============================

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

  reload.enabled: false

# ======================= Elasticsearch template setting =======================

setup.template.settings:
  index.number_of_shards: 1
setup.ilm.overwrite: true

# =================================== Kibana ===================================

setup.kibana:
  host: "ElasticsearchAdress"

# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  hosts: ["http://ElasticsearchAdress:9200"]
  username: "login"
  password: "passwd"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

Answer 1

Check your version of FileBit and Kibana, they may be different, so the method is not supported.