<p>I've also posted this as a question on the official Elastic forum, but that doesn't seem super frequented.</p>

<p><a href="https://discuss.elastic.co/t/x-pack-check-on-oss-docker-image/198521" rel="nofollow noreferrer">https://discuss.elastic.co/t/x-pack-check-on-oss-docker-image/198521</a></p>

<p>At any rate, here's the query:</p>

<p>We're running a managed AWS Elasticsearch cluster — not ideal, but that's life — and run most the rest of our stuff with Kubernetes. We recently upgraded our cluster to Elasticsearch 7, so I wanted to upgrade the Filebeat service we have running on the Kubernetes nodes to capture logs.</p>

<p>I've specified <code>image: docker.elastic.co/beats/filebeat-oss:7.3.1</code> in my daemon configuration, but I still see</p>

<pre><code>Connection marked as failed because the onConnect callback failed:
request checking for ILM availability failed:
401 Unauthorized: {"Message":"Your request: '/_xpack' is not allowed."}
</code></pre>

<p>in the logs. Same thing when I've tried other 7.x images. A bug? Or something that's new in v7?</p>

<p>The license file is an Apache License, and the build when I do <code>filebeat version</code> inside the container is <code>a4be71b90ce3e3b8213b616adfcd9e455513da45</code>.</p>

<p>It turns out that starting in one of the 7.x versions they turned on index lifecycle management checks by default. ILM (index lifecycle management) is an X-Pack feature, so turning this on by default means that Filebeat will do an X-Pack check by default.</p>

<p>This can be fixed by adding <code>setup.ilm.enabled: false</code> to the Filebeat configuration. So, not a bug per se in the OSS Docker build.</p>
