🚨 Filebeat Error: 'Index management requested but the Elasticsearch output is not configured/enabled' — Cause, Fix, and Troubleshooting Guide

Overview

Index management (templates, ILM policies, data streams) is applied through Filebeat’s Elasticsearch output. If you ask Filebeat to set up index management but the active output is Logstash — or the ES output is disabled — Filebeat has no ES connection to do it and refuses:

Exiting: Index management requested but the Elasticsearch output is not configured/enabled

This is common in Filebeat → Logstash → Elasticsearch topologies. filebeat setup (and setup.template/setup.ilm) need a direct Elasticsearch output to install templates and ILM, but the running config points at Logstash. Filebeat exits rather than silently skipping setup. The fix is to point setup at Elasticsearch explicitly, even though normal shipping goes through Logstash.

Symptoms

• Exiting: Index management requested but the Elasticsearch output is not configured/enabled.
• Triggered by filebeat setup while output.logstash is enabled and output.elasticsearch is not.
• Or at startup when setup.ilm/setup.template is enabled with a non-ES output.
• Templates/ILM never get installed, so downstream indexing later fails.

Common Root Causes

• Logstash output active with no Elasticsearch output for setup to use.
• output.elasticsearch.enabled: false while setup is requested.
• Running filebeat setup on a host configured only for Logstash.
• setup.ilm.enabled: true at startup without an ES output.

How to diagnose

Confirm which output is enabled:

grep -A3 'output\.\(elasticsearch\|logstash\)' /etc/filebeat/filebeat.yml
grep -i 'setup\.\(ilm\|template\)' /etc/filebeat/filebeat.yml

Fixes

Run setup with a temporary Elasticsearch output (disabling Logstash just for the setup command):

filebeat setup --index-management -e \
  -E 'output.logstash.enabled=false' \
  -E 'output.elasticsearch.enabled=true' \
  -E 'output.elasticsearch.hosts=["https://es01:9200"]' \
  -E 'output.elasticsearch.username=elastic' \
  -E 'output.elasticsearch.password=${ES_PASS}'

Keep the running config on Logstash for shipping, and disable startup-time index management so Filebeat does not exit on boot:

output.logstash:
  hosts: ["logstash01:5044"]

setup.ilm.enabled: false        # do setup out-of-band, not at startup
setup.template.enabled: false

Have Logstash’s elasticsearch output write to the managed data stream/ILM alias you created during setup, then restart Filebeat.

What to watch out for

• Setup always needs a direct ES output — Logstash cannot install templates/ILM.
• Disable setup.* at startup for Logstash-shipping agents so they do not exit.
• The --index-management override is temporary; your persistent output stays Logstash.
• Make sure Logstash writes to the same index/data stream that setup provisioned.

Related

• Filebeat Error: ‘Filebeat is unable to load the ingest pipelines’
• Filebeat Error Guide: ‘ILM policy not found’
• Filebeat Error Guide: ‘could not load index template’