Could not locate that index-pattern (id: filebeat-*), click here to re-create it

[jmoran8888]

I was running ELK perfectly fine v7.3.0. I wanted to add user management and enabled xpack.security.enabled: true - fixed all the authentication errors that caused - created a couple of dashboard only users. However now when i log into kibana with the elastic username - when i bring up the dashboards ([Filebeat Nginx] Access and error logs ECS for example) - i am getting one visualization that works fine and the other two are coming back with Could not locate that index-pattern (id: filebeat-*), [click here to re-create it] - however that index pattern already does exist.
Same with this [Filebeat Nginx] Overview ECS - some visualizations load and others get that error. For [Filebeat System] Syslog dashboard ECS nothing loads at all

[lukas (Lukas Olson)]

Could you export one of the visualizations causing this error and paste the contents here? And could you also go to the index pattern page and screenshot and provide here?

It sounds like although you have an index pattern set up for filebeat-*, it may not be the same index pattern ID linked to in the visualizations you have set up. (Keep in mind that filebeat-* is not the ID, it's the title.)

[jmoran8888]

Hi Lukas -

Thank you for your reply. I am trying to use the out-of-the-box dashboard for Nginx
[[Filebeat Nginx] Overview ECS] - some visualizations work and others give the "could not locate" error
Its the same with all the out of the box dashboards. The syslog one
[Filebeat System] Syslog dashboard ECS - doesnt show ANY visualizations at all

These were all working fine until i set the xpack.security.enabled: true and make the config changes for the authentication - after that it stopped working.

I am logged into Kibana as elastic user.

Thanks