Filebeat 7.3.1 - Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified

[dcenaculo (Daniel Cenáculo)]

Hi,

I'm using Elastic Stack 7.3.1 and Filebeat 7.3.1. Now, when I try to start the filebeat, the following message appears:

PS C:\filebeat-7.3.1-windows-x86_64> .\filebeat.exe
Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified

It was working fine through the logstash but I must have done something bad in the meantime ...

When I try to use some Filebeat Kibana's Dashboard, it gives the following message:

Could not locate that index-pattern (id: filebeat-*), click here to re-create it

I have already tried to recreate the index-pattern in Kibana but it continues to give the same error. Anyway, at this point, the filebeat doesn't even start.

Where do I start in order to reset Filebeat and its index-patterns to the default configuration (ELK 7.3.1)?

I appreciate all the help because I have little experience and I need to collect logs from an FTPS server and try to present some graphs of its use ...

Thanks in Advance,
Daniel

[dcenaculo (Daniel Cenáculo)]

If I use Logstash I can start Filebeat and it create daily indices:

filebeat-2021.03.03
filebeat-2021.03.04

But when I try to use Filebeat visualizations it gives an error:

There is a problem with this saved object

The index pattern associated with this object no longer exists.

If you know what this error means, go ahead and fix it — otherwise click the delete button above.

Or try to use filebeat dashboards, it also gives an error:

Could not locate that index-pattern (id: filebeat-*), click here to re-create it

How can I rebuild this index-pattern well?

Thanks in Advance,
Daniel

[mtojek (Marcin Tojek)]

I'm wondering if it's not a similar thread: Filebeat Index Issue - template pattern / name