🚨 Filebeat Error: 'dataset ... has no template' — Cause, Fix, and Troubleshooting Guide

Overview

When Filebeat writes to a target that has no matching index template — often a custom index name, a module dataset whose template was never loaded, or a data stream that does not exist — Elasticsearch cannot apply the expected mappings and the write is rejected:

Failed to publish events caused by: dataset [nginx.error] has no template; the index template for the data stream may not have been installed. Run 'filebeat setup' or reload the template.

Filebeat (and Elastic Agent style integrations) resolve events to a type-dataset-namespace data stream. If the backing index template for that dataset was never installed, Elasticsearch has no mappings/settings to create the stream and refuses the bulk items. Nothing indexes for that dataset until the template is present.

Symptoms

• has no template in the publish error, naming a specific dataset like nginx.error.
• Only some datasets fail — the ones whose module/integration template was not loaded.
• filebeat setup was skipped, or run against a different cluster than the output points at.
• GET _index_template/<name> returns 404 for the expected template.

Common Root Causes

• filebeat setup never ran against the target cluster, so templates were not installed.
• Module template missing — a module was enabled after setup, so its dataset template is absent.
• setup.template.enabled: false with no template loaded out of band.
• Wrong cluster — setup ran against a dev cluster but the output ships to prod.
• Custom index: name that no template pattern matches.

How to diagnose

Check whether the template for the dataset exists:

curl -sk 'https://es01:9200/_index_template?pretty' -u elastic:$ES_PASS | \
  grep -i 'filebeat\|nginx'
curl -sk 'https://es01:9200/_index_template/filebeat?pretty' -u elastic:$ES_PASS

Confirm which output cluster Filebeat targets and which modules are enabled:

grep -A5 'output.elasticsearch' /etc/filebeat/filebeat.yml
filebeat modules list

Fixes

Run setup against the cluster the output points at to install templates and pipelines:

filebeat setup --index-management -e \
  -E 'output.elasticsearch.hosts=["https://es01:9200"]' \
  -E 'output.elasticsearch.username=elastic' \
  -E 'output.elasticsearch.password=${ES_PASS}'

If a module was enabled after setup, re-run setup so its dataset template loads:

filebeat modules enable nginx
filebeat setup --index-management
systemctl restart filebeat

For a custom index:, make sure a template pattern matches it, or point back at the managed data stream:

output.elasticsearch:
  hosts: ["https://es01:9200"]
  # index: "custom-%{[agent.version]}"   # only if a matching template exists
setup.template.name: "filebeat"
setup.template.pattern: "filebeat-*"

What to watch out for

• filebeat setup must run against the same cluster the output writes to.
• Enabling a module later requires re-running setup for its template.
• If you disable setup.template.enabled, you own installing the template yourself.
• Custom index names need a custom template pattern, or writes will hit this error.

Related

• Filebeat Error Guide: ‘could not load index template’
• Filebeat Error Guide: ‘ILM policy not found’
• Filebeat Error: ‘Filebeat is unable to load the ingest pipelines’