Repository package build problem v7.x: url.PathEscape failing & causing 405 Method Not Allowed

[casesolved-co-uk]

It appears standard filebeat create alias functionality is causing: {"error":"Incorrect HTTP method for uri [/<filebeat-7.17.23-{now/d}-000001>] and method [PUT], allowed: [POST]","status":405}

It appears the url.PathEscape in the following code is failing somehow: https://github.com/elastic/beats/blob/bd0ffc1af3bb6c6b0b61e4324f8d9e905b60b45a/libbeat/idxmgmt/ilm/client_handler.go#L178-L194

I've raised a forum issue here but had no luck so far: https://discuss.elastic.co/t/incorrect-http-method-for-uri-405-method-not-allowed/370661

Same error on 7.17.25

[casesolved-co-uk]

Okay so it appears this is a build issue. The version from https://artifacts.elastic.co/packages/7.x/apt installed with apt on Ubuntu 20.04 fails But a freshly built version of filebeat (same version) gives a different error:

2024-11-19T15:57:50.354Z    INFO    template/load.go:197    Existing template will be overwritten, as overwrite is enabled.
2024-11-19T15:57:50.602Z    INFO    template/load.go:131    Try loading template filebeat-7.17.23 to Elasticsearch
2024-11-19T15:57:50.624Z    INFO    template/load.go:123    Template with name "filebeat-7.17.23" loaded.
2024-11-19T15:57:50.624Z    INFO    [index-management]  idxmgmt/std.go:296  Loaded index template.
2024-11-19T15:57:50.640Z    ERROR   [index-management.ilm]  ilm/std.go:133  Index Alias filebeat-7.17.23 setup failed: failed to create alias: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}: 400 Bad Request: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}.
2024-11-19T15:57:50.640Z    ERROR   instance/beat.go:1027   Exiting: failed to create alias: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}: 400 Bad Request: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}
Exiting: failed to create alias: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}: 400 Bad Request: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}

Network traces obtained from tshark: Freshly built version of filebeat:

HTTP 481 PUT /%3Cfilebeat-7.17.23-%7Bnow%2Fd%7D-000001%3E HTTP/1.1  (application/json)
HTTP 738 HTTP/1.1 400 Bad Request  (application/json)

Repository version:

HTTP 764 PUT /<filebeat-7.17.25-{now/d}-000001> HTTP/1.0  (application/json)
HTTP 341 HTTP/1.0 405 Method Not Allowed  (application/json)

[casesolved-co-uk]

Does not affect v8 since it does not use aliases:

https://www.elastic.co/guide/en/beats/libbeat/8.16/breaking-changes-8.0.html

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[AndersonQ]

@casesolved-co-uk what ES version are you using?

[casesolved-co-uk]

Fails with both 7.17.23 and 7.17.25. filebeat and elasticsearch are the same version on the same server Not sure why that matters, the url sent by filebeat is wrong, no issue with elasticsearch

[belimawr]

I've tried to reproduce it with the .deb and the one installed via apt, on both tries everything worked for me.

@casesolved-co-uk can you reproduce it if use the files (Linux/tar.gz) downloaded from our downloads page https://www.elastic.co/downloads/past-releases/filebeat-7-17-25?

[casesolved-co-uk]

Like I said, a fresh build works fine. I didn't use the tarball but I checked out the tag using git then built it.

Are you using ubuntu 20.04, and configured apt to use the repo above?

[casesolved-co-uk]

What is your output from tshark upon creating an alias?

tshark -i lo -f "tcp port 9200" -Y "http"

I don't know if this is a hint but I noticed the one that fails uses HTTP/1.0 but successful with HTTP/1.1

[casesolved-co-uk]

Maybe linked against an old go library?