🚨 Filebeat Error: 'Index management requested but the Elasticsearch output is not configured/enabled' — Cause, Fix, and Troubleshooting Guide

What this error means

Index management (templates, ILM policies, data streams) is applied through Filebeat’s Elasticsearch output. If you ask Filebeat to set up index management but the active output is Logstash — or the ES output is disabled — Filebeat has no ES connection to do it and refuses:

Exiting: Index management requested but the Elasticsearch output is not configured/enabled

This is common in Filebeat → Logstash → Elasticsearch topologies. filebeat setup (and setup.template/setup.ilm) need a direct Elasticsearch output to install templates and ILM, but the running config points at Logstash. Filebeat exits rather than silently skipping setup. The fix is to point setup at Elasticsearch explicitly, even though normal shipping goes through Logstash.

Observed behaviour

• Exiting: Index management requested but the Elasticsearch output is not configured/enabled.
• Triggered by filebeat setup while output.logstash is enabled and output.elasticsearch is not.
• Or at startup when setup.ilm/setup.template is enabled with a non-ES output.
• Templates/ILM never get installed, so downstream indexing later fails.

Storage and state causes

• Logstash output active with no Elasticsearch output for setup to use.
• output.elasticsearch.enabled: false while setup is requested.
• Running filebeat setup on a host configured only for Logstash.
• setup.ilm.enabled: true at startup without an ES output.

Inspecting stored state

Confirm which output is enabled:

grep -A3 'output\.\(elasticsearch\|logstash\)' /etc/filebeat/filebeat.yml
grep -i 'setup\.\(ilm\|template\)' /etc/filebeat/filebeat.yml

Resolution

Run setup with a temporary Elasticsearch output (disabling Logstash just for the setup command):

filebeat setup --index-management -e \
  -E 'output.logstash.enabled=false' \
  -E 'output.elasticsearch.enabled=true' \
  -E 'output.elasticsearch.hosts=["https://es01:9200"]' \
  -E 'output.elasticsearch.username=elastic' \
  -E 'output.elasticsearch.password=${ES_PASS}'

Keep the running config on Logstash for shipping, and disable startup-time index management so Filebeat does not exit on boot:

output.logstash:
  hosts: ["logstash01:5044"]

setup.ilm.enabled: false        # do setup out-of-band, not at startup
setup.template.enabled: false

Have Logstash’s elasticsearch output write to the managed data stream/ILM alias you created during setup, then restart Filebeat.

Protecting state integrity

• Setup always needs a direct ES output — Logstash cannot install templates/ILM.
• Disable setup.* at startup for Logstash-shipping agents so they do not exit.
• The --index-management override is temporary; your persistent output stays Logstash.
• Make sure Logstash writes to the same index/data stream that setup provisioned.

Related storage errors

• Filebeat Error: ‘Filebeat is unable to load the ingest pipelines’
• Filebeat Error Guide: ‘ILM policy not found’
• Filebeat Error Guide: ‘could not load index template’