ERROR: Could not locate that index-pattern-field on filebeat

Sujith · July 17, 2017, 10:56am

Hi All,

I have installed ELK stack 5.5.0 Version and beats as of the only file beat installed on my machine.

When i import file beat dashboard and visualization of 5.5.0 version, I'm getting below error while clicking on those visualization and dashboards.

Please check and let us know how do we solve this.

Could not locate that index-pattern-field (id: system.syslog.hostname)

And also it shows for all the fields which i click on visualizations and dashboards.

Sujith · July 18, 2017, 2:08pm

Hi Team,

Can someone reply us, please.?

Sujith · July 20, 2017, 11:46am

Any update on the above issue, please.?

tudor · July 20, 2017, 1:32pm

Can you show us which commands you used to load the dashboards?

Sujith · July 20, 2017, 3:25pm

Hi Tudor,

I use below command for importing filebeat dashboard and visualizations.

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards -dir "D:\ELK-Stack5.5\beats-dashboards-5.5.0\filebeat"

tudor · July 20, 2017, 3:28pm

Did you happen to refresh the index pattern (in Kibana) by any chance? If yes, can you try reloading the dashboards again, without refreshing the index pattern.

Sujith · July 20, 2017, 3:31pm

I have tried both Tudor, even with refresh the index pattern and also deleted the index pattern and created new file beat index pattern and imported again only the dashboard and visualization and searches still this issue comes when i click on any visualizations.

tudor · July 21, 2017, 9:19am

@Sujith I can't reproduce the issue with ES, Kibana, and Filebeat all at version 5.5.0. Do you have the same? I didn't test on Windows, but I don't expect that to make a difference.

Btw, is there a reason you used the -dir option? if you just run .\import_dashboards, it downloads the dashboards for you. Can you try that, please?

Sujith · July 21, 2017, 12:12pm

@tudor Yes, as per the process in document i used -dir option where as to import from local path location.

Since then if i don't use -dir and directly use the command as .\import_dashboards, then i get below error.

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards.exe
Created temporary directory C:\Users\skumar10\AppData\Local\Temp\tmp457694015
Downloading https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.5.0.zip
.\import_dashboards.exe : Error importing URL/file: Failed to download file:
https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.5.0.zip. Error: Get
https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.5.0.zip: dial tcp 184.73.227.9:443: i/o timeout
At line:1 char:1

.\import_dashboards.exe

  + CategoryInfo          : NotSpecified: (Error importing...43: i/o timeout:String) [], RemoteException
  + FullyQualifiedErrorId : NativeCommandError

Exiting

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts>

tudor · July 21, 2017, 12:16pm

Ok, can you try using the -file option where you pass it the zip directly? Something like: .\import_dashboards.exe -file beats-dashboards-5.5.0.zip

The error seems to indicate that the index pattern is not correctly loaded, but I have no idea why that would be the case.

Sujith · July 21, 2017, 1:12pm

@tudor i have used -file too still no luck of importing .

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards.exe -file D:\ELK-Stack5.5\beats.zip
Created temporary directory C:\Users\skumar10\AppData\Local\Temp\tmp340107743
Unzip archive C:\Users\skumar10\AppData\Local\Temp\tmp340107743
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp340107743\filebeat\dashboard
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp340107743\filebeat\search
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp340107743\filebeat\visualization

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards.exe -file "D:\ELK-Stack5.5\beats.zip"
Created temporary directory C:\Users\skumar10\AppData\Local\Temp\tmp853898895
Unzip archive C:\Users\skumar10\AppData\Local\Temp\tmp853898895
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp853898895\filebeat\dashboard
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp853898895\filebeat\search
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp853898895\filebeat\visualization

Sujith · July 24, 2017, 1:15pm

@tudor please reply us what needs to be fixed for importing file beat dashboards.

Sujith · July 28, 2017, 11:36am

Hi Team,

Can anyone reply to us the solution, please? It would be great to hear from someone from ELK team about a solution to my issue regarding Filebeat Visualizations and Dashboards.

gregsh · August 4, 2017, 7:18pm

Sujith · August 7, 2017, 11:27am

please anyone from the team can help us solving this error in filebeat dashboard and visualization of 5.5.0 version

gregsh · August 7, 2017, 2:48pm

I found that deleting my Kibana indexes (and losing my past data) helped solve the problem. Once Kibana "saw" the Filebeat data it built a new index and the field parameters. I'm still learning ELK and Beats so this method is probably not correct, but it helped my issue.

Sujith · August 8, 2017, 6:33pm

@gregsh i have tried deleting my Kibana indexes and filebeat with new index, Still no luck

gregsh · August 8, 2017, 7:28pm

Try this, delete Kibana indexes then on a client or on the host load Filebeat (see here)
Then run "filebeat.sh -e -modules=system,auditd -setup" - this will add the searches, visualizations and dashboards for Filebeat system and auditd.
Start Filebeat on your client(s) and then look at Kibana after a minute. You should see it has a filebeat-* index and that there are events in Discover. Check out the Dashboard section for the Filebeat dashboards.
This worked for me. I have stayed away from the index refresh, it seems to corrupt things.

system · September 5, 2017, 7:28pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Could not locate that index-pattern-field(id: field name) Kibana	2	2843	August 25, 2017
Cannot get dashboard/visualizations to load Kibana	4	4785	December 6, 2018
Filebeat 6.2.1 Dashboard errors: Could not locate that index-pattern-field Beats filebeat	3	653	March 16, 2018
[Winlogbeat 7.10.1 dashboards]: could not locate some index pattern fields Beats winlogbeat	6	449	February 16, 2021
[bug] setup.dashboards.index not working for filebeat nor winlogbeat Beats filebeat , winlogbeat	3	397	June 25, 2021

ERROR: Could not locate that index-pattern-field on filebeat

Related Topics