# Enable modules & Could not locate that index-pattern-field

**URL:** <https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986>\
**Category:** Kibana\
**Created:** [May 23, 2018, 11:47am UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986 "2018-05-23T11:47:27Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [May 23, 2018, 11:47am UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986/1 "2018-05-23T11:47:27Z")

</div>

Hello,  
I am trying to enable system module in Elasticsearch (6.2.\*). I have used CLI (on kibana):

```
filebeat modules enable system

```

But when I go to kibana I get the following message:

```
Could not locate that index-pattern-field (id: system.syslog.hostname)

```

or

```
Could not locate that index-pattern-field (id: system.auth.ssh.event)

```

or  
...

What is missing ?

---

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [May 23, 2018, 12:22pm UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986/2 "2018-05-23T12:22:11Z")

</div>

I also ran the following command:

```
filebeat setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["myelk:9200"]'

```

But it didn't help.  
What am I supposed to run now ?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [May 24, 2018, 9:09am UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986/3 "2018-05-24T09:09:04Z")

</div>

What is the output of `./filebeat modules list`? Have you set index pattern in Kibana on startup? Have you tried sending messages already?

---

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [May 24, 2018, 9:27am UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986/4 "2018-05-24T09:27:28Z")

</div>

```
filebeat modules list

```

Enabled:  
nginx  
system

Disabled:  
apache2  
auditd  
icinga  
kafka  
logstash  
mysql  
osquery  
postgresql  
redis  
traefik

I have set index pattern in Kibana with `filebeat-*` and I already have data there (in Discovery). But then I added those two modules but cannot see any dashboards ...

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [May 24, 2018, 10:32am UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986/5 "2018-05-24T10:32:55Z")

</div>

It seems to me that it is a Kibana error. Could you post your question in the Kibana forum?

---

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [May 24, 2018, 4:25pm UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986/6 "2018-05-24T16:25:24Z")

</div>

Of course !

---

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [May 30, 2018, 7:43am UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986/7 "2018-05-30T07:43:30Z")

</div>

Any hint what might be wrong ?

---

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [May 30, 2018, 3:44pm UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986/8 "2018-05-30T15:44:46Z")

</div>

From the log:  
|2018-05-30T15:28:33.283Z|INFO|kibana/client.go:69|Kibana url: http://localhost:5601| |---|---|---|---|  
|2018-05-30T15:28:59.279Z|INFO|instance/beat.go:583|Kibana dashboards successfully loaded.|  
|2018-05-30T15:28:59.279Z|INFO|instance/beat.go:301|filebeat start running.|

But:

```
curl -s http://localhost:9200/.kibana/dashboard/_search?pretty

```

`{ "took" : 0, "timed_out" : false, "_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : 0, "max_score" : null, "hits" : [] } }`

Don't really understand - is it supposed to display all the dashboards or not ?

---

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [May 31, 2018, 9:50am UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986/9 "2018-05-31T09:50:35Z")

</div>

Anyone any hint to help ?

---

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [June 19, 2018, 6:19am UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986/10 "2018-06-19T06:19:04Z")

</div>

Can anyone help me please ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2018, 6:19am UTC](https://discuss.elastic.co/t/enable-modules-could-not-locate-that-index-pattern-field/132986/11 "2018-07-17T06:19:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
