Apache2 -Could not locate that index-pattern-field

[msina (Mohammad Abu Sina)]

Hi,

In kibana dashboard we are getting below error.

We have followed the steps mentioned here
https://www.elastic.co/guide/en/beats/filebeat/6.3/filebeat-module-apache2.html

Our Setup:
"version" : {
"number" : "6.3.0",
"build_flavor" : "default",
"build_type" : "rpm",
"build_hash" : "424e937",
"build_date" : "2018-06-11T23:38:03.357887Z",
"build_snapshot" : false,
"lucene_version" : "7.3.1",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"

Logstash.conf for apache-access

[type] == "apache-access" {
grok {
match => [ "message", "%{IPORHOST:clientip} - %{USER:ident} %{HTTPDATE:timestamp} %{QS}" ]
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
}

Please suggest and let me know if you need any further information.

Thanks

[Marius_Dragomir]

The guide over there requires no logstash in between filebeat and elasticsearch, so you don't need to do the Grok filter as that will dump the fields created by filebeat and create other ones. Try running it with Filebeat connected directly to Elasticsearch.

[msina (Mohammad Abu Sina)]

Hi,

I think i need to be more clear about our current setup.We have 3 ELK node cluster.
And multiple clients those are running apache webserver, and clients are sending logs to ELK logstash server using filebeat.

Now in ELK master node where elastic search,kibana and logstash is running ,we have installed another filebeat according to the document and tried to load the dash board and got above error.

In each webserver we are using filebeat to send (access,error and application )logs to logstash .
Our target is to capture a dashboard which will show apache access and error logs each transaction with user agent,error code and IP.

Do we need to install another filebeat agent in each webserver and connect with Elastic search.
In existing filebeat we already have the logstash and log path configured.

Could you please suggest .

[msina (Mohammad Abu Sina)]

I have commented the logstash configuartion in filebeat and keep only elastic search configuration.

[root@dis01 filebeat]# filebeat test output
elasticsearch: http://10.123.65.158:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 10.123.65.158
dial up... OK
TLS... WARN secure connection disabled
talk to server... OK
version: 6.3.0

Then ran the filebeat setup command

[root@dis01 sina]# filebeat setup
Loaded index template
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards
Loaded machine learning job configurations

But still error.

Please suggest.