# Could not locate that index-pattern-field (id: iis.access.response\_code) **URL:** \ **Category:** Kibana\ **Created:** [January 3, 2019, 7:00am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750 "2019-01-03T07:00:28Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![hoanguyen195](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@hoanguyen195](https://discuss.elastic.co/u/hoanguyen195)\ **Post date:** [January 3, 2019, 7:00am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/1 "2019-01-03T07:00:28Z")
Hi I have the error when setup dashboard Filebeat ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/4/6/464df4ca6cfc38d2b83dc305e541fa81133fd6cb.png) And i run `GET _cat/indices` ![50](https://us1.discourse-cdn.com/elastic/original/3X/c/8/c8cd6fcacd426e627101089100de1610a3216888.png) here my discover ![100](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc369f3248268313679469a67f2c1cbf3c43c7c7.png) ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [January 3, 2019, 11:31pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/2 "2019-01-03T23:31:45Z")
what process did you follow to set up this index pattern and dashboard? It looks like the Kibana index pattern does not have the field the visualizations are built on. ---
**Author:** ![hoanguyen195](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@hoanguyen195](https://discuss.elastic.co/u/hoanguyen195)\ **Post date:** [January 4, 2019, 12:11am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/3 "2019-01-04T00:11:42Z")
i set up this index pattern and dashboard from ./filebeat.exe setup --dashboard. Yes the Kibana index pattern does not have iis.access.response\_code index pattern of me ![2](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1faa8a6b36d700cf8bcb183d8e4cf5605fa93e78.png) ![3](https://us1.discourse-cdn.com/elastic/original/3X/2/1/21f21431dea84c8d3b2ca8fa65711870d2f48684.png) ![4](https://us1.discourse-cdn.com/elastic/original/3X/2/b/2bf9d695fe234ade17a48d9dc6ff09df8c57ae0f.png) How to add field iis.access.repons\_code in filebeat-\* ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [January 4, 2019, 5:26pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/4 "2019-01-04T17:26:06Z")
Try refreshing the field list (the refresh icon at the top right of the screenshot you posted). If that doesn't fix it, you may not actually have those fields in your Elasticsearch index. Check Elasticsearch manually to ensure those fields are there, if they aren't then filebeat may not be set up properly. ---
**Author:** ![hoanguyen195](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@hoanguyen195](https://discuss.elastic.co/u/hoanguyen195)\ **Post date:** [January 5, 2019, 3:38am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/5 "2019-01-05T03:38:54Z")
how to config filebeat for have the field iis.acceess.\*???? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 5, 2019, 4:55am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/6 "2019-01-05T04:55:01Z")
These dashboards require that you enable and use the [Filebeat IIS module](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-iis.html) which will parse the data and create the correct format for you. ---
**Author:** ![hoanguyen195](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@hoanguyen195](https://discuss.elastic.co/u/hoanguyen195)\ **Post date:** [January 5, 2019, 6:20am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/7 "2019-01-05T06:20:11Z")
yes i did enable iis modules ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00c73f54174ad1833470471de147479e5376ea14.png) But the format the Field only have 43 fields ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 5, 2019, 6:43am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/8 "2019-01-05T06:43:32Z")
Then it might not be correctly configured. ---
**Author:** ![hoanguyen195](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@hoanguyen195](https://discuss.elastic.co/u/hoanguyen195)\ **Post date:** [January 5, 2019, 6:47am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/9 "2019-01-05T06:47:34Z")
This is the iis configuration file ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/6/0/60e1277ef0095ef8d6f52fd26d670c7afe3b66af.png) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 5, 2019, 7:06am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/10 "2019-01-05T07:06:31Z")
Did you refresh the field list as Matt suggested? What does a document look like if you view it in the Discover app? ---
**Author:** ![hoanguyen195](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@hoanguyen195](https://discuss.elastic.co/u/hoanguyen195)\ **Post date:** [January 5, 2019, 8:29am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/12 "2019-01-05T08:29:24Z")
i did refresh the field my discover app display 43 field ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 5, 2019, 9:06am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/13 "2019-01-05T09:06:47Z")
What do s you filebeat.yml file look like? ---
**Author:** ![hoanguyen195](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@hoanguyen195](https://discuss.elastic.co/u/hoanguyen195)\ **Post date:** [January 5, 2019, 9:22am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/14 "2019-01-05T09:22:16Z")
My filbeat.yml ![9](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7cd91a1d1c843af13cf485543928a894d07492bf.png) ![8](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d872a775ecdaec82554ac5757f358c5f2656968a.png) ![7](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fb3d475a2ddbf3ce7ac486febc5be02f634de1f9.png) ![6](https://us1.discourse-cdn.com/elastic/original/3X/5/8/58fda867eccc7abf06f1fa0dfc955fe68dc13e42.png) ![5](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8a2796f9b976564d28a81462b1d1942c150e7176.png) ![4](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3d2ad313483936a10e0272d91a3d022344a9c5ae.png) ` ---
**Author:** ![hoanguyen195](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@hoanguyen195](https://discuss.elastic.co/u/hoanguyen195)\ **Post date:** [January 8, 2019, 6:14am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/15 "2019-01-08T06:14:51Z")
You can answer my question? Thank ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 8, 2019, 7:32am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/16 "2019-01-08T07:32:02Z")
I do not spot anything obviously wrong. Not sure why it is not working. ---
**Author:** ![hoanguyen195](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@hoanguyen195](https://discuss.elastic.co/u/hoanguyen195)\ **Post date:** [January 9, 2019, 6:31am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/17 "2019-01-09T06:31:53Z")
i have not Elastic stack. It is needed for this? i was install Elasticsearch + Logstash + Kibana. What else do I need to install? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 6, 2019, 6:31am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-iis-access-response-code/162750/18 "2019-02-06T06:31:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.