ERROR: Could not locate that index-pattern-field on filebeat


(Kumar) #1

Hi All,

I have installed ELK stack 5.5.0 Version and beats as of the only file beat installed on my machine.

When i import file beat dashboard and visualization of 5.5.0 version, I'm getting below error while clicking on those visualization and dashboards.

Please check and let us know how do we solve this.

Could not locate that index-pattern-field (id: system.syslog.hostname)

And also it shows for all the fields which i click on visualizations and dashboards.


(Kumar) #2

Hi Team,

Can someone reply us, please.?


(Kumar) #3

Any update on the above issue, please.?


(Tudor Golubenco) #4

Can you show us which commands you used to load the dashboards?


(Kumar) #5

Hi Tudor,

I use below command for importing filebeat dashboard and visualizations.

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards -dir "D:\ELK-Stack5.5\beats-dashboards-5.5.0\filebeat"


(Tudor Golubenco) #6

Did you happen to refresh the index pattern (in Kibana) by any chance? If yes, can you try reloading the dashboards again, without refreshing the index pattern.


(Kumar) #7

I have tried both Tudor, even with refresh the index pattern and also deleted the index pattern and created new file beat index pattern and imported again only the dashboard and visualization and searches still this issue comes when i click on any visualizations.


(Tudor Golubenco) #8

@Sujith I can't reproduce the issue with ES, Kibana, and Filebeat all at version 5.5.0. Do you have the same? I didn't test on Windows, but I don't expect that to make a difference.

Btw, is there a reason you used the -dir option? if you just run .\import_dashboards, it downloads the dashboards for you. Can you try that, please?


(Kumar) #9

@tudor Yes, as per the process in document i used -dir option where as to import from local path location.

Since then if i don't use -dir and directly use the command as .\import_dashboards, then i get below error.

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards.exe
Created temporary directory C:\Users\skumar10\AppData\Local\Temp\tmp457694015
Downloading https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.5.0.zip
.\import_dashboards.exe : Error importing URL/file: Failed to download file:
https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.5.0.zip. Error: Get
https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.5.0.zip: dial tcp 184.73.227.9:443: i/o timeout
At line:1 char:1

  • .\import_dashboards.exe
  •   + CategoryInfo          : NotSpecified: (Error importing...43: i/o timeout:String) [], RemoteException
      + FullyQualifiedErrorId : NativeCommandError
    
    

Exiting

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts>


(Tudor Golubenco) #10

Ok, can you try using the -file option where you pass it the zip directly? Something like: .\import_dashboards.exe -file beats-dashboards-5.5.0.zip

The error seems to indicate that the index pattern is not correctly loaded, but I have no idea why that would be the case.


(Kumar) #11

@tudor i have used -file too still no luck of importing .

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards.exe -file D:\ELK-Stack5.5\beats.zip
Created temporary directory C:\Users\skumar10\AppData\Local\Temp\tmp340107743
Unzip archive C:\Users\skumar10\AppData\Local\Temp\tmp340107743
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp340107743\filebeat\dashboard
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp340107743\filebeat\search
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp340107743\filebeat\visualization

PS D:\ELK-Stack5.5\filebeat-5.5.0-windows-x86_64\scripts> .\import_dashboards.exe -file "D:\ELK-Stack5.5\beats.zip"
Created temporary directory C:\Users\skumar10\AppData\Local\Temp\tmp853898895
Unzip archive C:\Users\skumar10\AppData\Local\Temp\tmp853898895
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp853898895\filebeat\dashboard
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp853898895\filebeat\search
Importing Kibana from C:\Users\skumar10\AppData\Local\Temp\tmp853898895\filebeat\visualization


(Kumar) #12

@tudor please reply us what needs to be fixed for importing file beat dashboards.


(Kumar) #13

Hi Team,

Can anyone reply to us the solution, please? It would be great to hear from someone from ELK team about a solution to my issue regarding Filebeat Visualizations and Dashboards.


(Greg) #14

I have the same issue with a Centos 7 instance with all 5.5.1 ELK and Filebeat. Error:
TypeError: "field" is a required parameter
at FieldAggParam.AggTypesParamTypesFieldProvider.FieldAggParam.write (http://ec2-54-165-21-197.compute-1.amazonaws.com:5601/bundles/kibana.bundle.js?v=15382:254:4916)
at http://ec2-54-165-21-197.compute-1.amazonaws.com:5601/bundles/kibana.bundle.js?v=15382:254:2513
at AggParams.forEach ()
at AggParams.AggTypesAggParamsProvider.AggParams.write (http://ec2-54-165-21-197.compute-1.amazonaws.com:5601/bundles/kibana.bundle.js?v=15382:254:2471)
at AggConfig.VisAggConfigProvider.AggConfig.write (http://ec2-54-165-21-197.compute-1.amazonaws.com:5601/bundles/kibana.bundle.js?v=15382:255:10051)
at AggConfig.VisAggConfigProvider.AggConfig.toDsl (http://ec2-54-165-21-197.compute-1.amazonaws.com:5601/bundles/kibana.bundle.js?v=15382:255:10880)
at http://ec2-54-165-21-197.compute-1.amazonaws.com:5601/bundles/kibana.bundle.js?v=15382:257:7400
at Array.forEach ()
at AggConfigs.VisAggConfigsProvider.AggConfigs.toDsl (http://ec2-54-165-21-197.compute-1.amazonaws.com:5601/bundles/kibana.bundle.js?v=15382:257:7183)
at http://ec2-54-165-21-197.compute-1.amazonaws.com:5601/bundles/kibana.bundle.js?v=15382:257:28628


(Kumar) #15

please anyone from the team can help us solving this error in filebeat dashboard and visualization of 5.5.0 version


(Greg) #16

I found that deleting my Kibana indexes (and losing my past data) helped solve the problem. Once Kibana "saw" the Filebeat data it built a new index and the field parameters. I'm still learning ELK and Beats so this method is probably not correct, but it helped my issue.


(Kumar) #17

@gregsh i have tried deleting my Kibana indexes and filebeat with new index, Still no luck


(Greg) #18

Try this, delete Kibana indexes then on a client or on the host load Filebeat (see here)
Then run "filebeat.sh -e -modules=system,auditd -setup" - this will add the searches, visualizations and dashboards for Filebeat system and auditd.
Start Filebeat on your client(s) and then look at Kibana after a minute. You should see it has a filebeat-* index and that there are events in Discover. Check out the Dashboard section for the Filebeat dashboards.
This worked for me. I have stayed away from the index refresh, it seems to corrupt things.


(system) #19

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.