Datafeed [datafeed-packetbeat_dns_tunneling] cannot retrieve data because no index matches datafeed's indices [packetbeat-*]

Elastic Stack Kibana
1

Hi folks
I have been searching high and low regarding this error and I am very new to the ELK stack.

ELK 8.7.1, using Elastic Agents on clients.

When I try to enable the ML job packetbeat_dns_tunneling it fails with the above error messages.
In general every ML job that involves the packetbeat -* indices fails to be created/run.

I did add the packetbeat integration to a policy, deployed to + 50 agents and the index is there, but I am clueless now as what to do about the above error.

Can someone point me in a direction for further investigation here

Cheers

2

Hi guys

do I have to set the 'index: packetbeat' in the logstash configuration here ?

..... is there a 'fast lane' here for questions, we have an Enterprise License, but I would rather have everybody benefiting from this discussion/issue here.

Cheers