# Cannot create Index Patterns of remote clusters - Kibana 7.10.0

**URL:** <https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206>\
**Category:** Kibana\
**Created:** [January 26, 2021, 8:51am UTC](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206 "2021-01-26T08:51:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Phandora](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phandora/32/46108_2.png) [@Phandora](https://discuss.elastic.co/u/Phandora)\
**Post date:** [January 26, 2021, 8:51am UTC](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206/1 "2021-01-26T08:51:47Z")

</div>

Hi, we are facing some problems creating index patterns in the 7.10.0 version.

When trying to **create the index pattern of a remote cluster** we got the error `No matching indices found`. However, the indexes do exist (the indexes are shown in the first step of the index pattern creation).

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/e/aed6d19ad38510eaabd7b43124a397fa333e27c6.png)

In step two, we can see there is something wrong before clicking on `Create index pattern` since the **Time field** menu does not appear, even when there are indices with timestamps.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4ec39dbcf0128dc5ab6b53930ee727fada1a8c43.png)

We got the following error after **creating the index pattern** :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/02165f696927483230163897f92ee221d2050d33.png)

If we go to `Discover`, the documents are displayed, but since there are no fields in the index pattern, **it does not allow filtering** using the document's fields.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/02353ad56099437584df58d32581a87ce53d656c.png)

If we create the index pattern using the API and adding some initial fields, they do appear on Discover and we can filter by them, but the index pattern can not be refreshed (we got the same error `No matching indices found`) so new fields can not be added to the index pattern.

Is this a known bug?

Best regards,  
Mayte Ariza

---

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [January 26, 2021, 4:55pm UTC](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206/2 "2021-01-26T16:55:48Z")

</div>

Hello @Phandora ,

Is there any reason why you are trying to make all the log sources in one index !!?  
I think it's for that, that you are getting errors  
If you want to create an index, create one for each beat,

Example: one for `filebeat-*` and another one for `packetbeat-` ....etc

---

<div class="post-metadata">

**Author:** ![Phandora](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phandora/32/46108_2.png) [@Phandora](https://discuss.elastic.co/u/Phandora)\
**Post date:** [January 26, 2021, 5:11pm UTC](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206/3 "2021-01-26T17:11:24Z")

</div>

Hi @TheHunter1,

It was just an example to explain our issue.

The remote index pattern fails for every index pattern we attempt to create, even for sample indices:

- Create index in remote cluster:

```auto
curl -XPUT -H 'Content-Type: application/json' localhost:9200/books/_doc/1 -d '{"Dracula": "Bram Stoker"}'

```

- Create index pattern in centralized environment:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af352a899b0203d176c9b5b3d61c7f6c2607f273.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/8/081408bd18776f75952c956442dd64bcfa5a5999.png)

---

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [January 27, 2021, 8:07am UTC](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206/4 "2021-01-27T08:07:19Z")

</div>

This may help you,

> [@No matching indices found: No indices match pattern \* - even when indices exist](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-even-when-indices-exist/124376/5):
>
> OK I figured it out... I'm not really sure why this fixed it but: The index name needs to be specified as the Index pattern ID, located in the Advanced Settings. [3-19-2018%202-11-46%20PM]

---

<div class="post-metadata">

**Author:** ![mof\_cmsmith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mof_cmsmith/32/83022_2.png) [@mof\_cmsmith](https://discuss.elastic.co/u/mof_cmsmith)\
**Post date:** [February 1, 2021, 3:31pm UTC](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206/5 "2021-02-01T15:31:20Z")

</div>

Could you be more specific? Is this in the kibana.yml or the main interface?

---

<div class="post-metadata">

**Author:** ![elasticuser1233](https://avatars.discourse-cdn.com/v4/letter/e/9de0a6/32.png) [@elasticuser1233](https://discuss.elastic.co/u/elasticuser1233)\
**Post date:** [February 19, 2021, 6:48am UTC](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206/6 "2021-02-19T06:48:35Z")

</div>

Hey All, I'm running into the exact same problem and the proposed solutions doesn't actually work. Anyone had any luck in solving this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2021, 6:48am UTC](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206/7 "2021-03-19T06:48:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
