Could not locate that index-pattern (auditbeat,filebat)

Elastic Stack Beats
1

Hi ,
It looks like when using custom pattern in auditbeat of filebeat, that ID for dashboards which are created with auditbeat or filebeat are created with extra space in the begging ,

For example in auditbeat I'm using:

output.elasticsearch.index: "my-testbeat-%{[beat.version]}-%{+yyyy.MM.dd}"
setup.template.name: "my-testbeat"
setup.template.pattern: "my-testbeat-*"
setup.dashboards.index: "my-testbeat-*"
setup.template.overwrite: true

then run:
auditbeat setup --dashboards

Then in Kibana dashboards I get:

01

Could not locate that index-pattern (id: my-testbeat-), c , however if I create new index pattern with name smth like my-test and define the index pattern ID with space in the begining like in an error:
==> "id: my-testbeat-*" , it start working.

with default name for index "auditbeat" it's working ok.

is a bug os smth ? I'm using the latest 6.2.2 auditbeat.

BR,
Illia

2

When loading the dashboards, the index pattern names must be replaced. I wonder if there is a problem with this name replacement. In kibana managent tab you can see object internals + json encoding of dashboards. I wonder if the patterns are correct.

Dashboard/Index-pattern loading wrosk differently per Kibana/Elasticsearch versions. Which versions are you using?

3

I'm using latest auditbeat 6.2.2 , and elastic+kibana 5.6.5.

In Kibana --> Managment --> saved objects --> in json for dashboard only id's no names:
[
{
"col": 1,
"id": "97680df0-c1c0-11e7-8995-936807a28b16",
"panelIndex": 1,
"row": 1,
"size_x": 6,
"size_y": 4,
"type": "visualization"
},
{
"col": 7,
"id": "08679220-c25a-11e7-8692-232bd1143e8a",
"panelIndex": 2,
"row": 1,
"size_x": 6,
"size_y": 4,
"type": "visualization"
},
{
"col": 1,
"columns": [
"beat.hostname",
"auditd.summary.actor.primary",
"auditd.summary.actor.secondary",
"event.action",
"auditd.summary.object.type",
"auditd.summary.object.primary",
"auditd.summary.object.secondary",
"auditd.summary.how",
"auditd.result"
],
"id": "0f10c430-c1c3-11e7-8995-936807a28b16",
"panelIndex": 3,
"row": 5,
"size_x": 12,
"size_y": 6,
"sort": [
"@timestamp",
"desc"
],
"type": "search"
}
]