ERROR: Could not locate that index-pattern-field on filebeat

Hi All,

I have installed ELK stack 5.5.0 Version and beats as of the only file beat installed on my machine.

When i import file beat dashboard and visualization of 5.5.0 version, I'm getting below error while clicking on those visualization and dashboards.

Please check and let us know how do we solve this.

Could not locate that index-pattern-field (id: system.syslog.hostname)

And also it shows for all the fields which i click on visualizations and dashboards.

Hi Team,

Can someone reply us, please.?

Any update on the above issue, please.?

Can you show us which commands you used to load the dashboards?

Hi Tudor,

I use below command for importing filebeat dashboard and visualizations.

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards -dir "D:\ELK-Stack5.5\beats-dashboards-5.5.0\filebeat"

Did you happen to refresh the index pattern (in Kibana) by any chance? If yes, can you try reloading the dashboards again, without refreshing the index pattern.

I have tried both Tudor, even with refresh the index pattern and also deleted the index pattern and created new file beat index pattern and imported again only the dashboard and visualization and searches still this issue comes when i click on any visualizations.

@Sujith I can't reproduce the issue with ES, Kibana, and Filebeat all at version 5.5.0. Do you have the same? I didn't test on Windows, but I don't expect that to make a difference.

Btw, is there a reason you used the -dir option? if you just run .\import_dashboards, it downloads the dashboards for you. Can you try that, please?

@tudor Yes, as per the process in document i used -dir option where as to import from local path location.

Since then if i don't use -dir and directly use the command as .\import_dashboards, then i get below error.

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards.exe
Created temporary directory C:\Users\skumar10\AppData\Local\Temp\tmp457694015
.\import_dashboards.exe : Error importing URL/file: Failed to download file: Error: Get dial tcp i/o timeout
At line:1 char:1

  • .\import_dashboards.exe
  •   + CategoryInfo          : NotSpecified: (Error importing...43: i/o timeout:String) [], RemoteException
      + FullyQualifiedErrorId : NativeCommandError


PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts>

Ok, can you try using the -file option where you pass it the zip directly? Something like: .\import_dashboards.exe -file

The error seems to indicate that the index pattern is not correctly loaded, but I have no idea why that would be the case.

@tudor i have used -file too still no luck of importing .

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards.exe -file D:\ELK-Stack5.5\
Created temporary directory C:\Users\skumar10\AppData\Local\Temp\tmp340107743
Unzip archive C:\Users\skumar10\AppData\Local\Temp\tmp340107743
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp340107743\filebeat\dashboard
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp340107743\filebeat\search
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp340107743\filebeat\visualization

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards.exe -file "D:\ELK-Stack5.5\"
Created temporary directory C:\Users\skumar10\AppData\Local\Temp\tmp853898895
Unzip archive C:\Users\skumar10\AppData\Local\Temp\tmp853898895
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp853898895\filebeat\dashboard
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp853898895\filebeat\search
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp853898895\filebeat\visualization

@tudor please reply us what needs to be fixed for importing file beat dashboards.

Hi Team,

Can anyone reply to us the solution, please? It would be great to hear from someone from ELK team about a solution to my issue regarding Filebeat Visualizations and Dashboards.

I have the same issue with a Centos 7 instance with all 5.5.1 ELK and Filebeat. Error:
TypeError: "field" is a required parameter
at FieldAggParam.AggTypesParamTypesFieldProvider.FieldAggParam.write (
at AggParams.forEach ()
at AggParams.AggTypesAggParamsProvider.AggParams.write (
at AggConfig.VisAggConfigProvider.AggConfig.write (
at AggConfig.VisAggConfigProvider.AggConfig.toDsl (
at Array.forEach ()
at AggConfigs.VisAggConfigsProvider.AggConfigs.toDsl (

please anyone from the team can help us solving this error in filebeat dashboard and visualization of 5.5.0 version

I found that deleting my Kibana indexes (and losing my past data) helped solve the problem. Once Kibana "saw" the Filebeat data it built a new index and the field parameters. I'm still learning ELK and Beats so this method is probably not correct, but it helped my issue.

@gregsh i have tried deleting my Kibana indexes and filebeat with new index, Still no luck

Try this, delete Kibana indexes then on a client or on the host load Filebeat (see here)
Then run " -e -modules=system,auditd -setup" - this will add the searches, visualizations and dashboards for Filebeat system and auditd.
Start Filebeat on your client(s) and then look at Kibana after a minute. You should see it has a filebeat-* index and that there are events in Discover. Check out the Dashboard section for the Filebeat dashboards.
This worked for me. I have stayed away from the index refresh, it seems to corrupt things.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.