ELK - Fresh setup: Could not locate that index-pattern-field

Elastic Stack Kibana
1

Hi!

I am new to ELK.

I just set up a 3 node cluster (V6.2, latest):

  • Node 1: Elasticsearch
  • Node 2: Kibana, Nginx, Filebeat, Metricbeat
  • Node 3: Logstash

I have connected a client VM using filebeat to logstash and I can see log events at discover.

As soon as I open Dashboard, it shows lot's of errors:

  • Could not locate that index-pattern-field (id: apache2.access.remote_ip)
  • Could not locate that index-pattern-field (id: apache2.access.response_code)
  • ...

[root@slde6001 ~]# metricbeat setup
Loaded index template
Loaded dashboards

[root@slde6001 ~]# filebeat setup
Loaded index template
Loaded dashboards
Loaded machine learning job configurations

I already deleted the "filebeat*" index and recreated with above commands.
Then I sent new log rows to filebeat which also displayed fine on discover but dashboards are still not functioning.

Any ideas?

Kind regards,
Kevin

2

Hey,

can you verify that filebeat and metricbeat are also version 6.2? Occasionally Kibana updates its saved objects format, and the dashboards uploaded by metricbeat need to match.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.