# Eror : No indices match pattern "filebeat-\*"

**URL:** <https://discuss.elastic.co/t/eror-no-indices-match-pattern-filebeat/173510>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 22, 2019, 2:55pm UTC](https://discuss.elastic.co/t/eror-no-indices-match-pattern-filebeat/173510 "2019-03-22T14:55:20Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![allfreed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/allfreed/32/42601_2.png) [@allfreed](https://discuss.elastic.co/u/allfreed)\
**Post date:** [March 22, 2019, 2:55pm UTC](https://discuss.elastic.co/t/eror-no-indices-match-pattern-filebeat/173510/1 "2019-03-22T14:55:20Z")

</div>

No matching indices found: No indices match pattern "filebeat-\*"

Hi , I want to get apache access.log but while adding filebeat index pattern show this error.

filebeat.yml file

 ![1](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d17f5ea9b0bf96db6523c956bebc9fd63b0ded7a.png) ![2](https://us1.discourse-cdn.com/elastic/original/3X/9/f/9fd356ec1ecd8919d72af3382c2d7d0c11679a82.png) ![3](https://us1.discourse-cdn.com/elastic/original/3X/1/1/11f956216e426ab08f527e8749ec19d4ba24ad71.png)

tried other beats(metricbeat,packetbeat) they are working but filebeat not working ,

tried -paths : /var/log/apache2/access.log but again error.  
Can you help me ? What is the problem

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [March 25, 2019, 10:14am UTC](https://discuss.elastic.co/t/eror-no-indices-match-pattern-filebeat/173510/2 "2019-03-25T10:14:36Z")

</div>

- Have you enabled the apache module?
- Have you setup templates, dashboards, etc. using `./filebeat setup`?
- Have you sent apache events to ES?

Next time please paste your configuration and format it using `</>`? Copy-pasting is much easier this way, if we want to test your configuration locally. 🙂

---

<div class="post-metadata">

**Author:** ![allfreed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/allfreed/32/42601_2.png) [@allfreed](https://discuss.elastic.co/u/allfreed)\
**Post date:** [March 25, 2019, 11:31am UTC](https://discuss.elastic.co/t/eror-no-indices-match-pattern-filebeat/173510/3 "2019-03-25T11:31:42Z")

</div>

I done it. But same result.  
 ![4](https://us1.discourse-cdn.com/elastic/original/3X/3/1/31e88fea42ee5423510f5c2b88c661188c06f912.png) ![5](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3d1a8c9200b2c43ef2fcdf742284b59bb5225ea4.png)

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [March 25, 2019, 11:46am UTC](https://discuss.elastic.co/t/eror-no-indices-match-pattern-filebeat/173510/4 "2019-03-25T11:46:51Z")

</div>

Could you please share your debug logs of Filebeat?

Please do not copy paste images with terminal output here. This makes investigating your issue much slower as we need to type the same thing you are sharing here. Which obviously takes more time than just copy-pasting what you have put here.

---

<div class="post-metadata">

**Author:** ![allfreed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/allfreed/32/42601_2.png) [@allfreed](https://discuss.elastic.co/u/allfreed)\
**Post date:** [March 25, 2019, 12:22pm UTC](https://discuss.elastic.co/t/eror-no-indices-match-pattern-filebeat/173510/5 "2019-03-25T12:22:43Z")

</div>

\</\>  
Elasticsearch version 6.6.2  
2019-03-22T15:33:32.823+0300 INFO template/load.go:130 Template already exists and will not be overwritten.  
2019-03-22T15:33:32.823+0300 INFO instance/beat.go:894 Template successfully loaded.  
2019-03-22T15:33:52.798+0300 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":60,"time":{"ms":2}},"total":{"ticks":150,"time":{"ms":22},"value":150},"user":{"ticks":90,"time":{"ms":20}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":11},"info":{"ephemeral\_id":"49d52f66-9f11-4373-af13-ce64b3600434","uptime":{"ms":273014}},"memstats":{"gc\_next":7325744,"memory\_alloc":4185040,"memory\_total":13851720,"rss":208896}},"filebeat":{"events":{"active":30,"added":30},"harvester":{"open\_files":3,"running":3}},"libbeat":{"config":{"module":{"running":0}},"output":{"read":{"bytes":1080},"write":{"bytes":381}},"pipeline":{"clients":4,"events":{"active":203,"published":30,"retry":1,"total":30}}},"registrar":{"states":{"current":3}},"system":{"load":{"1":0.07,"15":0.95,"5":0.29,"norm":{"1":0.0233,"15":0.3167,"5":0.0967}}}}}}  
2019-03-22T15:34:22.797+0300 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":60},"total":{"ticks":160,"time":{"ms":16},"value":160},"user":{"ticks":100,"time":{"ms":16}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":11},"info":{"ephemeral\_id":"49d52f66-9f11-4373-af13-ce64b3600434","uptime":{"ms":303015}},"memstats":{"gc\_next":7325744,"memory\_alloc":5401232,"memory\_total":15067912,"rss":200704}},"filebeat":{"events":{"active":38,"added":38},"harvester":{"open\_files":3,"running":3}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":4,"events":{"active":241,"published":38,"total":38}}},"registrar":{"states":{"current":3}},"system":{"load":{"1":0.04,"15":0.92,"5":0.26,"norm":{"1":0.0133,"15":0.3067,"5":0.0867}}}}}}  
2019-03-22T15:34:29.983+0300 ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch([http://10.10.10.6:9200](http://10.10.10.6:9200))): Connection marked as failed because the onConnect callback failed: Error loading pipeline for fileset apache2/access: This module requires the following Elasticsearch plugins: ingest-user-agent, ingest-geoip. You can install them by running the following commands on all the Elasticsearch nodes:  
sudo bin/elasticsearch-plugin install ingest-user-agent  
sudo bin/elasticsearch-plugin install ingest-geoip  
2019-03-22T15:34:29.983+0300 INFO pipeline/output.go:93 Attempting to reconnect to backoff(elasticsearch([http://10.10.10.6:9200](http://10.10.10.6:9200))) with 8 reconnect attempt(s)  
2019-03-22T15:34:29.983+0300 INFO [publish] pipeline/retry.go:189 retryer: send unwait-signal to consumer  
2019-03-22T15:34:29.983+0300 INFO [publish] pipeline/retry.go:191 done  
2019-03-22T15:34:29.983+0300 INFO [publish] pipeline/retry.go:166 retryer: send wait signal to consumer  
2019-03-22T15:34:29.983+0300 INFO [publish] pipeline/retry.go:168 done  
2019-03-22T15:34:29.986+0300 INFO elasticsearch/client.go:721 Connected to Elasticsearch version 6.6.2  
2019-03-22T15:34:29.989+0300 INFO template/load.go:130 Template already exists and will not be overwritten.  
2019-03-22T15:34:29.989+0300 INFO instance/beat.go:894 Template successfully loaded.  
2019-03-22T15:34:52.799+0300 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":70,"time":{"ms":9}},"total":{"ticks":190,"time":{"ms":20},"value":190},"user":{"ticks":120,"time":{"ms":11}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":11},"info":{"ephemeral\_id":"49d52f66-9f11-4373-af13-ce64b3600434","uptime":{"ms":333014}},"memstats":{"gc\_next":8308384,"memory\_alloc":6649880,"memory\_total":16316560,"rss":593920}},"filebeat":{"events":{"active":36,"added":36},"harvester":{"open\_files":3,"running":3}},"libbeat":{"config":{"module":{"running":0}},"output":{"read":{"bytes":1080},"write":{"bytes":381}},"pipeline":{"clients":4,"events":{"active":277,"published":36,"retry":19,"total":36}}},"registrar":{"states":{"current":3}},"system":{"load":{"1":0.02,"15":0.89,"5":0.23,"norm":{"1":0.0067,"15":0.2967,"5":0.0767}}}}}}

\</\>

---

<div class="post-metadata">

**Author:** ![allfreed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/allfreed/32/42601_2.png) [@allfreed](https://discuss.elastic.co/u/allfreed)\
**Post date:** [March 25, 2019, 12:40pm UTC](https://discuss.elastic.co/t/eror-no-indices-match-pattern-filebeat/173510/6 "2019-03-25T12:40:01Z")

</div>

firstly i installed ingest-user-agent,ingest-geoip , after that install beat , but result same

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 22, 2019, 12:40pm UTC](https://discuss.elastic.co/t/eror-no-indices-match-pattern-filebeat/173510/7 "2019-04-22T12:40:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
