# AWS elb and vpcflow log filebeat visualizations fail to load properly

**URL:** <https://discuss.elastic.co/t/aws-elb-and-vpcflow-log-filebeat-visualizations-fail-to-load-properly/266608>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 8, 2021, 9:44pm UTC](https://discuss.elastic.co/t/aws-elb-and-vpcflow-log-filebeat-visualizations-fail-to-load-properly/266608 "2021-03-08T21:44:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![EvanGertis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evangertis/32/85191_2.png) [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\
**Post date:** [March 8, 2021, 9:44pm UTC](https://discuss.elastic.co/t/aws-elb-and-vpcflow-log-filebeat-visualizations-fail-to-load-properly/266608/1 "2021-03-08T21:44:31Z")

</div>

I am trying to develop more visibility around aws. I'd really like to use the prebuilt dashboards that come with filebeat, but I seem to constantly run into issues with the visualizations for elb and vpcflow logs. My configuration looks like this:

```auto
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
setup.kibana:
  host: "localhost:5601"
setup.dashboards.enabled: true
setup.dashboards.directory: ${path.config}/kibana
setup.ilm.enabled: false
output.elasticsearch:
  hosts: ["localhost:9200"]
  indices:
  - index: "cloudtrail-%{[agent.version]}-%{+yyyy.MM.dd}"
    when.contains:
      event.dataset: "aws.cloudtrail"
  - index: "elb-%{[agent.version]}-%{+yyyy.MM.dd}"
    when.contains:
      event.dataset: "aws.elb"
  - index: "vpc-%{[agent.version]}-%{+yyyy.MM.dd}"
    when.contains:
      event.dataset: "aws.vpc"
processors:
  - add_fields:
      target: my_env
      fields:
        environment: development

```

In my dashboards directory I changed the `filebeat-*` index to  
`vpc-*` for `Filebeat-aws-vpcflow-overview.json`, `cloudtrail-*` for `filebeat-aws-cloudtrail.json` and `elb-*` for `Filebeat-aws-elb-overview.json`. The cloudtrail dashboard works just fine. I only run into issues with the `elb` and `vpcflow` visualizations. None of elb requests visualizations work. The top ip addresses for vpcflow logs do not work either. Here are some screenshots

 ![Screen Shot 2021-03-08 at 4.33.15 PM](https://us1.discourse-cdn.com/elastic/original/3X/d/9/d9010dfeff01b2e916d62f98fc80da3006135b4e.jpeg)

 ![Screen Shot 2021-03-08 at 4.43.22 PM](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a58c87e9bb28d0224164777f6db5ffb94f6d0831.jpeg)

Any help with this would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2021, 11:44pm UTC](https://discuss.elastic.co/t/aws-elb-and-vpcflow-log-filebeat-visualizations-fail-to-load-properly/266608/2 "2021-04-05T23:44:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.