Filebeat Errors

Elastic Stack Kibana
1

Hello there,

Trying in the Kibana section since the Filebeat is not much help and hardly anyone gets back to me. I am having this issue with Filebeat configuration in Kibana. This is my setup:

Kibana Elasticsearch Version 6.1.2 on Ubuntu 16.04

Kibana/Ealsticsearch work well with the Metricbeat I setup initially, I setup an index called "metricbeat-" and imported all Metric Dashboards and life makes sense. Beautiful dashboards. I then thought "oh I want to log all Apache/Nginx logs in both my ELK Server and another Host that has Apache" I configured Filebeat on both ELK server and host by installing the Filebeat, enabling the modules, starting the filebeat deamon and also imported the Filebeat Dashboards. I log into Kibana and made an index called, "filebeat-" and that works 'cause I can go into Discover and and see all logs coming in. Life makes sense up to this point. Then I go to the Dashboards of Apache and all of them state "Could not locate that index-pattern (id: filebeat-), [click here to re-create it]" so I deleted the index filebeat- and re-add it again but no dice. When I go into Visualize and I try to see one of the simple Apache Visualizations I see this:

image
image.png1889×1750 234 KB

Can anyone please help me set this up? Anyone out there who has the patience :confused:

2

I tried to get help in the "Beats" section and I uploaded all the screenshots there but hardly anyone responded. Metricbeat Apache Info

3

Hello,
That error message might be a bit misleading. It's looking for the index pattern UUID to be equal to filebeat-* and not the index pattern name. You can look in the .kibana index at the document for your metricbeat-* index pattern and your filebeat-* index pattern

You can delete the filebeat-* index pattern (don't worry, it won't delete any data) and then create it again, but on the 2nd page of the creation wizzard go in the advanced settings and set the ID to filebeat-* as well.

uuid
uuid.png1689×526 34.4 KB

1 Like
4

Hey thanks for getting back to me. Sorry I'm quite new to ELK, where is this .kibana index? Am I looking in the /etc/filebeat /etc/metricbeat folders within the actual server or is this .kibana index inside the Kibana Web Interface?

I see this at the Discover logs section, is this the ID that it is looking for?

image
image.png813×730 77.3 KB

5

this is the filebeat log in my ELK server, is the Beat UUID the one I have to type in the Index pattern, when creating a new one?

image
image.png835×653 140 KB

6

@Marius_Dragomir So I fixed the issue thanks to you! I deleted both metricbeat-* and filebeat-* and readded them using the "advanced settings" and typing the same for the ID and suddenly everything worked. I just wanna say thank you because nobody else helped me or bothered to look in my issue
Thanks a lot Marius!!! it was such an easy fix yet so hard for me

7

Happy you found the fix. Sorry for pointing you at the more complicated fix first.
Just to answer the questions in case somebody else will read this thread in a couple of months:

  1. The .kibana index is store inside Elasticsearch, so to see it you would have to create a .kibana index pattern in Kibana and that will allow you to look at it.
  2. The Beat UUID is used for Beats Monitoring (you can see that in the sidebar if you have X-Pack installed), but it's different from the index pattern UUID.
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.