Can not create index patterns for filebeat-*, but I can see the logs from kibana's logs plugin

I just installed Elastic Stack 7.2 using Azure ARM template and configured fiebeats to export data to it. Everything looks works pretty straightforward. I can see the logs from kibana's logs plugin and also see the metrics for beats and everything looks works well.

But, I can not create index patterns using filebeat-*, even the logs plugin are able to use the same pattern to show logs. I tried to both creating an index pattern manually and have filebeats to create it by importing some built-in filebeats dashboard, unfortunately, both failed.
The error message is

Failed to fetch

Error: Failed to fetch

Also here is one snapshot to show all filebeat indices are healthy.

In the above environment, I tried sample data and those data works, and I am able to get the kibana index patterns, dashboards, etc. What could be the issue that only filebeat-* indices can not create kibana index patterns?

Hey @yuecong, welcome to the discussion boards!

This is a rather interesting problem. So the sample data works correctly, and the Logs UI is able to stream these filebeat-* logs, but you're unable to create filebeat-* index patterns.

Are you able to manually create any other index patterns? For example, can you create a pattern of kibana*?

Yes, I can manually create index patterns for other indices.
e.g. Here are the snapshot I created index patterns for the sample data and the one index pattern for the system indicies even.

Thanks for the update. Can you post your Kibana logs after attempting to create a filebeat-* index pattern?

If possible, I'd also like to get a HAR of this process so that I can see what the browser is sending/receiving during this process. There's a guide here showing how to capture a HAR:

If you can generate a HAR, please DM that to me rather than posting in the public board.

Thanks @Larry_Gregory for the help. close this one as we can not reproduce it now.

My pleasure!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.