Repository package build problem v7.x: url.PathEscape failing & causing 405 Method Not Allowed

[casesolved-co-uk]

It appears standard filebeat create alias functionality is causing:
{"error":"Incorrect HTTP method for uri [/<filebeat-7.17.23-{now/d}-000001>] and method [PUT], allowed: [POST]","status":405}

It appears the url.PathEscape in the following code is failing somehow:

beats/libbeat/idxmgmt/ilm/client_handler.go

Lines 178 to 194 in bd0ffc1

	// CreateAlias sends request to Elasticsearch for creating alias.
	func (h *ESClientHandler) CreateAlias(alias Alias) error {
	// Escaping because of date pattern
	// This always assume it's a date pattern by sourrounding it by <...>
	firstIndex := fmt.Sprintf("<%s-%s>", alias.Name, alias.Pattern)
	firstIndex = url.PathEscape(firstIndex)
	body := common.MapStr{
	"aliases": common.MapStr{
	alias.Name: common.MapStr{
	"is_write_index": true,
	},
	},
	}
	// Note: actual aliases are accessible via the index
	if _, res, err := h.client.Request("PUT", "/"+firstIndex, "", nil, body); err != nil {

I've raised a forum issue here but had no luck so far:
https://discuss.elastic.co/t/incorrect-http-method-for-uri-405-method-not-allowed/370661

Same error on 7.17.25

[casesolved-co-uk]

Okay so it appears this is a build issue.
The version from https://artifacts.elastic.co/packages/7.x/apt installed with apt on Ubuntu 20.04 fails
But a freshly built version of filebeat (same version) gives a different error:

2024-11-19T15:57:50.354Z	INFO	template/load.go:197	Existing template will be overwritten, as overwrite is enabled.
2024-11-19T15:57:50.602Z	INFO	template/load.go:131	Try loading template filebeat-7.17.23 to Elasticsearch
2024-11-19T15:57:50.624Z	INFO	template/load.go:123	Template with name "filebeat-7.17.23" loaded.
2024-11-19T15:57:50.624Z	INFO	[index-management]	idxmgmt/std.go:296	Loaded index template.
2024-11-19T15:57:50.640Z	ERROR	[index-management.ilm]	ilm/std.go:133	Index Alias filebeat-7.17.23 setup failed: failed to create alias: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}: 400 Bad Request: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}.
2024-11-19T15:57:50.640Z	ERROR	instance/beat.go:1027	Exiting: failed to create alias: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}: 400 Bad Request: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}
Exiting: failed to create alias: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}: 400 Bad Request: {"error":{"root_cause":[{"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"}],"type":"resource_already_exists_exception","reason":"index [filebeat-7.17.23-2024.11.19-000001/aQqBpbD-SmSlbbDWj6VZlA] already exists","index_uuid":"aQqBpbD-SmSlbbDWj6VZlA","index":"filebeat-7.17.23-2024.11.19-000001"},"status":400}

Network traces obtained from tshark:
Freshly built version of filebeat:

HTTP 481 PUT /%3Cfilebeat-7.17.23-%7Bnow%2Fd%7D-000001%3E HTTP/1.1  (application/json)
HTTP 738 HTTP/1.1 400 Bad Request  (application/json)

Repository version:

HTTP 764 PUT /<filebeat-7.17.25-{now/d}-000001> HTTP/1.0  (application/json)
HTTP 341 HTTP/1.0 405 Method Not Allowed  (application/json)

[casesolved-co-uk]

Does not affect v8 since it does not use aliases:

https://www.elastic.co/guide/en/beats/libbeat/8.16/breaking-changes-8.0.html

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[AndersonQ]

@casesolved-co-uk what ES version are you using?

[casesolved-co-uk]

Fails with both 7.17.23 and 7.17.25. filebeat and elasticsearch are the same version on the same server
Not sure why that matters, the url sent by filebeat is wrong, no issue with elasticsearch

[belimawr]

I've tried to reproduce it with the .deb and the one installed via apt, on both tries everything worked for me.

@casesolved-co-uk can you reproduce it if use the files (Linux/tar.gz) downloaded from our downloads page https://www.elastic.co/downloads/past-releases/filebeat-7-17-25?

[casesolved-co-uk]

Like I said, a fresh build works fine. I didn't use the tarball but I checked out the tag using git then built it.
I used the latest version of golang from the ubuntu ppa, and precompiled mage.

Are you using ubuntu 20.04, and configured apt to use the repo above?

[casesolved-co-uk]

What is your output from tshark upon creating an alias?

tshark -i lo -f "tcp port 9200" -Y "http"

I don't know if this is a hint but I noticed the one that fails uses HTTP/1.0 but successful with HTTP/1.1

[casesolved-co-uk]

Maybe linked against an old go library?