Could not locate that index-pattern-field (id: iis.access.response_code)

I have the error when setup dashboard Filebeat

And i run GET _cat/indices

here my discover

what process did you follow to set up this index pattern and dashboard? It looks like the Kibana index pattern does not have the field the visualizations are built on.

i set up this index pattern and dashboard from ./filebeat.exe setup --dashboard.
Yes the Kibana index pattern does not have iis.access.response_code
index pattern of me

How to add field iis.access.repons_code in filebeat-*

Try refreshing the field list (the refresh icon at the top right of the screenshot you posted). If that doesn't fix it, you may not actually have those fields in your Elasticsearch index. Check Elasticsearch manually to ensure those fields are there, if they aren't then filebeat may not be set up properly.

how to config filebeat for have the field iis.acceess.*????

These dashboards require that you enable and use the Filebeat IIS module which will parse the data and create the correct format for you.

yes i did enable iis modules

But the format the Field only have 43 fields

Then it might not be correctly configured.

This is the iis configuration file

Did you refresh the field list as Matt suggested? What does a document look like if you view it in the Discover app?

i did refresh the field
my discover app display 43 field

What do s you filebeat.yml file look like?

My filbeat.yml


You can answer my question? Thank

I do not spot anything obviously wrong. Not sure why it is not working.

i have not Elastic stack. It is needed for this?
i was install Elasticsearch + Logstash + Kibana. What else do I need to install?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.