# Error: No matching indices found: No indices match pattern "filebeat-\*"

**URL:** <https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 12, 2017, 8:10am UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675 "2017-10-12T08:10:01Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 12, 2017, 8:10am UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/1 "2017-10-12T08:10:01Z")

</div>

No matching indices found: No indices match pattern "filebeat-\*"

Less Info  
OK  
Error: No matching indices found: No indices match pattern "filebeat-\*"  
at [http://localhost:5601/bundles/kibana.bundle.js?v=15976:231:26352](http://localhost:5601/bundles/kibana.bundle.js?v=15976:231:26352)  
at processQueue ([http://localhost:5601/bundles/commons.bundle.js?v=15976:39:9912](http://localhost:5601/bundles/commons.bundle.js?v=15976:39:9912))  
at [http://localhost:5601/bundles/commons.bundle.js?v=15976:39:10805](http://localhost:5601/bundles/commons.bundle.js?v=15976:39:10805)  
at Scope.$digest ([http://localhost:5601/bundles/commons.bundle.js?v=15976:39:21741](http://localhost:5601/bundles/commons.bundle.js?v=15976:39:21741))  
at Scope.$apply ([http://localhost:5601/bundles/commons.bundle.js?v=15976:39:24520](http://localhost:5601/bundles/commons.bundle.js?v=15976:39:24520))  
at done ([http://localhost:5601/bundles/commons.bundle.js?v=15976:38:9495](http://localhost:5601/bundles/commons.bundle.js?v=15976:38:9495))  
at completeRequest ([http://localhost:5601/bundles/commons.bundle.js?v=15976:38:13952](http://localhost:5601/bundles/commons.bundle.js?v=15976:38:13952))  
at XMLHttpRequest.xhr.onload ([http://localhost:5601/bundles/commons.bundle.js?v=15976:38:14690](http://localhost:5601/bundles/commons.bundle.js?v=15976:38:14690))

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so

# you can use different prospectors for various configurations.

# Below are the prospector specific configurations.

- type: log

#============================= Filebeat modules ===============================

filebeat.config.modules:

# Glob pattern for configuration loading

path: ${path.config}/modules.d/\*.yml

# Set to true to enable config reloading

reload.enabled: false

# Period on which files under path should be checked for changes

#reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:  
index.number\_of\_shards: 3  
#index.codec: best\_compression  
#\_source.enabled: false

#================================ General =====================================

setup.kibana:

# Kibana Host

# Scheme and port can be left out and will be set to the default (http and 5601)

# In case you specify and additional path, the scheme is required: [http://localhost:5601/path](http://localhost:5601/path)

# IPv6 addresses should always be defined as: https://[2001:db8::1]:5601

host: "localhost:5601"

#----------------------------- Logstash output --------------------------------  
output.logstash:

# The Logstash hosts

hosts: ["localhost:5044"]

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [October 13, 2017, 7:24am UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/2 "2017-10-13T07:24:49Z")

</div>

Hi,

Indices are created after you start sending logs using filebeat to outputs. Have started to forward logs to your outputs?

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 13, 2017, 7:49am UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/3 "2017-10-13T07:49:51Z")

</div>

Yes  
2017-10-13T09:38:10+02:00 INFO Harvester started for file: /mylog.log  
2017-10-13T09:38:10+02:00 INFO Harvester started for file: mylog.log  
2017-10-13T09:38:10+02:00 INFO Harvester started for file: mylog.log  
2017-10-13T09:38:10+02:00 INFO Harvester started for file: mylog.log  
2017-10-13T09:38:10+02:00 INFO Harvester started for file: mylog.log  
2017-10-13T09:38:10+02:00 INFO Harvester started for file: mylog  
2017-10-13T09:38:10+02:00 INFO Harvester started for file: mylog.log  
2017-10-13T09:38:10+02:00 INFO Harvester started for file: mylog.log  
2017-10-13T09:38:10+02:00 INFO Harvester started for file: mylog.log  
2017-10-13T09:38:11+02:00 ERR Failed to connect: dial tcp localhost:5044: getsockopt: connection refused  
2017-10-13T09:38:13+02:00 ERR Failed to connect: dial tcp localhost:5044: getsockopt: connection refused

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [October 13, 2017, 12:10pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/4 "2017-10-13T12:10:37Z")

</div>

Could you please share your whole filebeat log? Also, please format it using `</>`.

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 13, 2017, 12:41pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/5 "2017-10-13T12:41:30Z")

</div>

\<###################### Filebeat Configuration Example #########################

# This file is an example configuration file highlighting only the most common

# options. The filebeat.reference.yml file from the same directory contains all the

# supported options with more comments. You can use it as a reference.

# 

# You can find the full configuration reference here:

# [https://www.elastic.co/guide/en/beats/filebeat/index.html](https://www.elastic.co/guide/en/beats/filebeat/index.html)

# For more available modules and options, please see the filebeat.reference.yml sample

# configuration file.

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so

# you can use different prospectors for various configurations.

# Below are the prospector specific configurations.

- type: log

#============================= Filebeat modules ===============================

filebeat.config.modules:

# Glob pattern for configuration loading

path: ${path.config}/modules.d/\*.yml

# Set to true to enable config reloading

reload.enabled: true

# Period on which files under path should be checked for changes

#reload.period: 10s

#================================ General =====================================

# The name of the shipper that publishes the network data. It can be used to group

# all the transactions sent by a single shipper in the web interface.

#name:

# The tags of the shipper are included in their own field with each

# transaction published.

#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the

# output.

#fields:

# env: staging

#============================== Dashboards =====================================

# These settings control loading the sample dashboards to the Kibana index. Loading

# the dashboards is disabled by default and can be enabled either by setting the

# options here, or by using the `-setup` CLI flag or the `setup` command.

#setup.dashboards.enabled: false

# The URL from where to download the dashboards archive. By default this URL

# has a value which is computed based on the Beat name and version. For released

# versions, this URL points to the dashboard archive on the [artifacts.elastic.co](http://artifacts.elastic.co)

# website.

#setup.dashboards.url:

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.

# This requires a Kibana endpoint configuration.

setup.kibana:

# Kibana Host

# Scheme and port can be left out and will be set to the default (http and 5601)

# In case you specify and additional path, the scheme is required: [http://localhost:5601/path](http://localhost:5601/path)

# IPv6 addresses should always be defined as: https://[2001:db8::1]:5601

host: "localhost"

#============================= Elastic Cloud ==================================

# These settings simplify using filebeat with the Elastic Cloud ([https://cloud.elastic.co/](https://cloud.elastic.co/)).

# The [cloud.id](http://cloud.id) setting overwrites the `output.elasticsearch.hosts` and

# `setup.kibana.host` options.

# You can find the `cloud.id` in the Elastic Cloud web UI.

#[cloud.id](http://cloud.id):

# The cloud.auth setting overwrites the `output.elasticsearch.username` and

# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.

#cloud.auth:

#================================ Outputs =====================================

# Configure what outputs to use when sending the data collected by the beat.

# Multiple outputs may be used.

#-------------------------- Elasticsearch output ------------------------------  
#output.elasticsearch:

# Array of hosts to connect to.

# hosts: ["localhost:9200"]

# Optional protocol and basic auth credentials.

#protocol: "https"  
#username: "elastic"  
#password: "changeme"

#----------------------------- Logstash output --------------------------------  
output.logstash:

# The Logstash hosts

```
hosts: ["localhost:5044"]

```

# Optional SSL. By default is off.

# List of root certificates for HTTPS server verifications

#ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"]

# Certificate for SSL client authentication

#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key

#ssl.key: "/etc/pki/client/cert.key"

#================================ Logging =====================================

# Sets log level. The default log level is info.

# Available log levels are: critical, error, warning, info, debug

#logging.level: debug

# At debug level, you can selectively enable logging only for some components.

# To enable all selectors use ["\*"]. Examples of other selectors are "beat",

# "publish", "service".

#logging.selectors: ["\*"]  
#filebeat.registry\_file: registry  
#registry\_file: /var/lib/filebeat/  
/\>

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 13, 2017, 12:42pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/6 "2017-10-13T12:42:00Z")

</div>

i am getting this message as well

2017-10-13T14:40:41+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory\_alloc=7824 beat.memstats.memory\_total=7824  
2017-10-13T14:41:11+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory\_alloc=8032 beat.memstats.memory\_total=8032  
2017-10-13T14:41:41+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory\_alloc=8240 beat.memstats.memory\_total=8240

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 13, 2017, 1:32pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/7 "2017-10-13T13:32:18Z")

</div>

Please properly format log output and config files using the `</>` button. Your post containing the config file is pretty unreadable.

Give the error message: `getsockopt: connection refused`, is Logstash even running?

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 13, 2017, 1:34pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/8 "2017-10-13T13:34:14Z")

</div>

logstash is running and listening on port 5044

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 13, 2017, 1:37pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/9 "2017-10-13T13:37:20Z")

</div>

```
filebeat.config.modules: 
  path: "${path.config}/modules.d/*.yml"
  reload.enabled: false
filebeat.prospectors: 
  - 
    enabled: true
    paths: 
      - /var/log/*.log
    type: log
output.logstash: 
  hosts: "localhost:5044"
setup.kibana: 
  hosts: "localhost:5601"
  template: 
    name: filebeat
    overwrite: false
    path: filebeat.template.json
```

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 13, 2017, 1:38pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/10 "2017-10-13T13:38:51Z")

</div>

```
my logstash file 
input {
 beats {
         port => 5400
   }    
}
  output {
    elasticsearch {
    hosts => "localhost:9200"
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
}
}
```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 13, 2017, 1:41pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/11 "2017-10-13T13:41:23Z")

</div>

hm... In your logstash config you are using port `5400` and in filebeat port `5044`.

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 13, 2017, 1:49pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/12 "2017-10-13T13:49:45Z")

</div>

```
i rectified the port , i am getting this message

 INFO Non-zero metrics in the last 30s: beat.memstats.gc_next=4473924 beat.memstats.memory_alloc=3322928 beat.memstats.memory_total=3322928 libbeat.config.reloads=1 libbeat.output.type=logstash
```

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 13, 2017, 2:41pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/13 "2017-10-13T14:41:54Z")

</div>

any ideas how to resolve this issue?

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 15, 2017, 8:43am UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/14 "2017-10-15T08:43:09Z")

</div>

Hi

Filebeat not indexing , getting message below - please help

```
2017-10-15T10:37:52+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory_alloc=12800 beat.memstats.memory_total=12800
2017-10-15T10:38:22+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory_alloc=12320 beat.memstats.memory_total=12320
2017-10-15T10:38:52+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory_alloc=-37176 beat.memstats.memory_total=13008
2017-10-15T10:39:22+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory_alloc=14136 beat.memstats.memory_total=14136
2017-10-15T10:39:52+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory_alloc=13008 beat.memstats.memory_total=13008
2017-10-15T10:40:22+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory_alloc=15008 beat.memstats.memory_total=15008
2017-10-15T10:40:52+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory_alloc=-42232 beat.memstats.memory_total=9632
2017-10-15T10:41:22+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory_alloc=16824 beat.memstats.memory_total=16824
2017-10-15T10:41:52+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory_alloc=10528 beat.memstats.memory_total=10528
2017-10-15T10:42:22+02:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory_alloc=12528 beat.memstats.memory_total=12528
```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 16, 2017, 2:39pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/15 "2017-10-16T14:39:08Z")

</div>

These are just internal metrics being printed every 30 seconds. You have a more complete log output?

What kind of files do you index?

You have any modules enabled? Filebeat modules are designed to work with Elasticsearch Ingest Node, integration with Logstash is not yet easily available.

---

<div class="post-metadata">

**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\
**Post date:** [October 19, 2017, 12:52pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/16 "2017-10-19T12:52:49Z")

</div>

Thanks i managed to sort the issue.  
logstash was not listening to the right port`Preformatted text`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2017, 12:52pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675/17 "2017-11-16T12:52:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.