Filebeat Autodiscover Failures: A Step‑by‑Step Diagnostic Guide

Problem Statement

When Filebeat’s Autodiscover feature stops applying templates, new log files are silently dropped. Operators see no new documents in Elasticsearch, no metrics for new services, and Filebeat logs report “autodiscover template applied” missing. This guide walks through the most common causes, how to verify each, and how to fix the issue without disrupting existing data streams.

Recognizable Symptoms

• Elasticsearch indices for new services are absent or empty.
• Filebeat logs contain warnings such as failed to load template or autodiscover template not found.
• The metrics endpoint (http://localhost:5066/metrics) shows no autodiscover events for the affected host.
• Filebeat continues to run but no new events appear in Kibana Discover.

Cause & Diagnostic Matrix

Cause	Diagnostic Indicator	Check
Filebeat syntax error in autodiscover section	Filebeat starts but logs failed to load module	Run filebeat test config -e
Missing or incompatible Elasticsearch index template	No expected fields in new indices	Query ES for index mapping
Filebeat and Elastic Stack version mismatch	Protocol errors in logs (Failed to send data)	Check filebeat version vs ES version
Filebeat service not receiving host metrics	Metrics endpoint shows zero events	Access http://localhost:5066/metrics
Incorrect file permissions preventing template load	Filebeat logs Permission denied	Verify file ownership and mode

Ordered Diagnostic Checks

1. Verify Filebeat is running and healthy

   systemctl status filebeat
   # Expect: active (running)
   

   Check the service logs for any startup errors.

2. Validate the configuration syntax

   filebeat test config -e -c /etc/filebeat/filebeat.yml
   

   Look for errors referencing the autodiscover section.

3. Confirm the metrics endpoint is exposing events

   curl -s http://localhost:5066/metrics | grep autodiscover
   

   Expect lines like filebeat_autodiscover_events_total{host="myhost"} 5. If zero, the host may not be sending metrics.

4. Check Elasticsearch for the expected index template

   curl -s -X GET "http://localhost:9200/_template/filebeat-autodiscover"
   

   Verify the order and settings match the Filebeat version.

5. Inspect the index mapping for new data

   curl -s -X GET "http://localhost:9200/filebeat-*/_mapping?pretty"
   

   Fields like module or service should appear if Autodiscover worked.

6. Cross‑check version compatibility

   filebeat version
   # Compare with Elastic Stack version from curl -s http://localhost:9200
   

   Use the Elastic compatibility matrix to ensure both are in the same major release.

Fixes Tied to Findings

• Syntax error in autodiscover
  • Open /etc/filebeat/filebeat.yml and correct YAML indentation or missing keys.
  • Run filebeat test config -e again.
  • Restart Filebeat: systemctl restart filebeat
• Missing or incompatible index template
  • Upload the correct template:

    curl -X PUT "http://localhost:9200/_template/filebeat-autodiscover" -H "Content-Type: application/json" -d @/etc/filebeat/filebeat-autodiscover-template.json
    

  • Optionally use -force if the template already exists but needs updating.
• Version mismatch
  • Upgrade or downgrade Filebeat to match the Elastic Stack.
  • Re‑install the matching version package and restart.
• Metrics endpoint not receiving data
  • Ensure the host’s filebeat.yml includes setup.dashboards.enabled: true and setup.template.enabled: true.
  • Check firewall rules blocking port 5066.
• Permission issue
  • Set correct ownership: chown root:filebeat /etc/filebeat/filebeat.yml and permissions 640.
  • Restart Filebeat after changes.

Escalation Criteria

If after following the steps the Autodiscover still fails:

• Confirm that the Filebeat logs show no autodiscover template applied entries for the affected host.
• Check network connectivity between Filebeat and Elasticsearch (e.g., telnet localhost 9200).
• Review system resource limits (e.g., open file descriptors) that could prevent Filebeat from opening log files.
• If the issue persists, open a ticket with Elastic Support or consult the community forums, providing:
• Filebeat version, Elastic Stack version, relevant log excerpts, and the output of the diagnostic commands above.

Practical Validation

After applying a fix, validate by:

• Running filebeat test config -e to ensure no errors.
• Checking the metrics endpoint for a new event count.
• Querying Elasticsearch for a new document in filebeat-* and inspecting the module field.
• Observing Kibana Discover to confirm the new logs appear.

Limitations

Filebeat configuration changes affect all hosts in the cluster. Always back up filebeat.yml and any custom templates before editing. Test changes in a staging environment when possible.

Conclusion

Filebeat Autodiscover failures are usually caused by configuration errors, missing templates, or version mismatches. By following the ordered diagnostic steps and applying the targeted fixes above, operators can restore automatic template application and resume log ingestion with minimal downtime.