# Filebeat connection issue **URL:** \ **Category:** Open Source Elasticsearch and Kibana\ **Created:** [April 16, 2019, 7:00am UTC](https://forum.opensearch.org/t/filebeat-connection-issue/437 "2019-04-16T07:00:25Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![kk23](https://avatars.discourse-cdn.com/v4/letter/k/edb3f5/32.png) [@kk23](https://forum.opensearch.org/u/kk23)\ **Post date:** [April 16, 2019, 7:00am UTC](https://forum.opensearch.org/t/filebeat-connection-issue/437/1 "2019-04-16T07:00:25Z")
Hi, I am getting below error with file beat setup sudo filebeat setup gives “Exiting: 1 error: Error checking if xpack is available: 500 Internal Server Error: {“error”:{“root\_cause”:[{“type”:“security\_exception”,“reason”:“Unexpected exception indices:admin/get”}],“type”:“security\_exception”,“reason”:“Unexpected exception indices:admin/get”},“status”:500}” appreciate if someone can assist filebeat.yml has this set but its not helping xpack.monitoring.enabled: false Elastic Search and Kibana are running but i need to send events using filebeat to ES and display in Kibana. appreciate if someone can assist Thanks, KK ---
**Author:** ![Nishant](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@Nishant](https://forum.opensearch.org/u/Nishant)\ **Post date:** [April 16, 2019, 12:03pm UTC](https://forum.opensearch.org/t/filebeat-connection-issue/437/2 "2019-04-16T12:03:41Z")
Can you share your filebeat.yml file? ---
**Author:** ![carlmead](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/carlmead/32/38_2.png) [@carlmead](https://forum.opensearch.org/u/carlmead)\ **Post date:** [April 17, 2019, 3:42pm UTC](https://forum.opensearch.org/t/filebeat-connection-issue/437/3 "2019-04-17T15:42:24Z")
Looks like you are not using the OSS version of Beats which does not have the X-Pack flags. They recently added checks that will not allow the commercially licensed agents/clients communicate with OSS versions of Elasticsearch. I suspect a lot of folks will run into this one. Make sure you are using this download: [Download Filebeat - OSS • Lightweight Log Analysis | Elastic](https://www.elastic.co/downloads/beats/filebeat-oss) Not this download: [Download Filebeat • Lightweight Log Analysis | Elastic](https://www.elastic.co/downloads/beats/filebeat) ---
**Author:** ![kk23](https://avatars.discourse-cdn.com/v4/letter/k/edb3f5/32.png) [@kk23](https://forum.opensearch.org/u/kk23)\ **Post date:** [April 19, 2019, 2:35am UTC](https://forum.opensearch.org/t/filebeat-connection-issue/437/4 "2019-04-19T02:35:21Z")
hi, Thanks for the reply i am now using filebeat-oss-7.0.0-x86\_64.rpm when i do sudo filebeat setup i still get an error which is > Blockquote > Exiting: 3 errors: Error checking if xpack is available: 500 Internal Server Error: {“error”:{“root\_cause”:[{“type”:“security\_exception”,“reason”:“Unexpected exception indices:admin/get”}],“type”:“security\_exception”,“reason”:“Unexpected exception indices:admin/get”},“status”:500}; Error checking if xpack is available: 500 Internal Server Error: {“error”:{“root\_cause”:[{“type”:“security\_exception”,“reason”:“Unexpected exception indices:admin/get”}],“type”:“security\_exception”,“reason”:“Unexpected exception indices:admin/get”},“status”:500}; Error checking if xpack is available: 500 Internal Server Error: {“error”:{“root\_cause”:[{“type”:“security\_exception”,“reason”:“Unexpected exception indices:admin/get”}],“type”:“security\_exception”,“reason”:“Unexpected exception indices:admin/get”},“status”:500} so its still not working not sure why appreciate your help, someone should have got this working for sure so its a puzzle this is not working. 🤔 ---
**Author:** ![kk23](https://avatars.discourse-cdn.com/v4/letter/k/edb3f5/32.png) [@kk23](https://forum.opensearch.org/u/kk23)\ **Post date:** [April 19, 2019, 5:16am UTC](https://forum.opensearch.org/t/filebeat-connection-issue/437/5 "2019-04-19T05:16:19Z")
finally this helped sudo filebeat setup -e --dashboards --pipelines --template its working I have just started a long way to go 😄 but thanks heaps for your help @carlmead otherwise i would have been stuck for ages 🙂 ---
**Author:** ![tbhaxor](https://avatars.discourse-cdn.com/v4/letter/t/ed655f/32.png) [@tbhaxor](https://forum.opensearch.org/u/tbhaxor)\ **Post date:** [March 8, 2020, 10:48pm UTC](https://forum.opensearch.org/t/filebeat-connection-issue/437/6 "2020-03-08T22:48:22Z")
Can anyone share their filebeat configuration please? ---
**Author:** ![ladistro](https://avatars.discourse-cdn.com/v4/letter/l/c67d28/32.png) [@ladistro](https://forum.opensearch.org/u/ladistro)\ **Post date:** [August 27, 2020, 6:21am UTC](https://forum.opensearch.org/t/filebeat-connection-issue/437/7 "2020-08-27T06:21:49Z")
I face the same issue even with filebeat oss. Why is it checking for \_xpack Setup: Centos: ES 7.6.1 OSS with Opendistro security enabled File beat [https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-oss-7.6.1-linux-x86\_64.tar.gz](https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-oss-7.6.1-linux-x86_64.tar.gz) when i enter ./filebeat setup i get the below errors in filebeat and es filebeat: Overwriting ILM policy is disabled. Set `setup.ilm.overwrite:true` for enabling. Exiting: request checking for ILM availability failed: 500 Internal Server Error: {“error”:{“root\_cause”:[{“type”:“security\_exception”,“reason”:“Unexpected exception indices:admin/get”}],“type”:“security\_exception”,“reason”:“Unexpected exception indices:admin/get”},“status”:500} ES: [2020-08-27T06:11:35,725][INFO][o.e.c.m.MetaDataMappingService] [node-1] [security-auditlog-2020.08.27/V8TPJbm9T-asyg2hDJRksg] update\_mapping [\_doc] [2020-08-27T06:13:07,123][ERROR][c.a.o.s.f.OpenDistroSecurityFilter] [node-1] Unexpected exception [\_xpack] InvalidIndexNameException[**Invalid index name [_xpack], must not start with '_'.**] org.elasticsearch.indices.InvalidIndexNameException: Invalid index name [_xpack], must not start with '_'. Same issue when i try ./filebeat setup -e --dashboards --pipelines --template ---
**Author:** ![ladistro](https://avatars.discourse-cdn.com/v4/letter/l/c67d28/32.png) [@ladistro](https://forum.opensearch.org/u/ladistro)\ **Post date:** [August 27, 2020, 6:44am UTC](https://forum.opensearch.org/t/filebeat-connection-issue/437/8 "2020-08-27T06:44:37Z")
for others who face the same issue: set > setup.ilm.enabled: false in filebeat.yml then it would work