Could not locate that index-pattern-field

Elastic Stack Beats
1

Hello,
I have some questions about this error I have when I run a visualization "Unique IPs map [Filebeat Apache2]".
I'm using filbeat to send logs of filezilla to logstash then to elasticsearch. The index name is "filebeat", the template is filebeat too. Everything is fine since yesterday.

I have configured filebeat with apache module to send logs of a web server.
I have put this :

setup.template.name: "filebeat"
setup.template.pattern: "filebeat-*"
index: "filebeat-web-%{+yyyy.MM.dd}"

It works fine, in filebeat, I see logs from apache and filezilla but when I run the visualization "Unique IPs map [Filebeat Apache2]", I have this error :

Could not locate that index-pattern-field (id: apache2.access.geoip.location)

In the index pattern, I don't see this field, I have

apache2.access.geoip.location.lat
apache2.access.geoip.location.lon

It seems I have to upload a new template from filebeat to put this new field in the template.
I have to overwrite the existent ? Is it safe ? What's the impact for the already log, visualization & dashboard ?

2

On a new server, I have installed filebeat and started it, now I have a lot of new fields in my index pattern " filebeat-*".

I see the field apache2.access.geoip.location but he's in conflict with another one.

To fix it, I have to close the other index and re-index ?

thanks for your help.

3

the solution was to reindex and refresh the mapping !
All cleared

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.