Filebeat IIS Default Dashboards

Elastic Stack Beats
1

Hello!

I tried to setup the filebeat iis module, following this guide: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-iis.html

After executing all the described steps, I wanted to try the created default dashboards, but there were none created in the kibana instance I defined in the configuration file of filebeat.

The log files of the IIS are processed, as they are available in the Discover module of kibana, I can also create my own custom visualizations with the indexed log data.

Is there something I am missing? (maybe a hidden configuration in filebeat or kibana?)

I hope anyone can give me some hints for solving this issue, thanks!

2

Hi,

If you configured the module through filebeat.yml file then you need to enable the dashboard configuration as below or enable by '-setup' CLI.

#============================== Dashboards =====================================
# These settings control loading the sample dashboards to the Kibana index. Loading
# the dashboards is disabled by default and can be enabled either by setting the
# options here, or by using the `-setup` CLI flag.
dashboards.enabled: true

Please check and try the same at your end or you can check the filebeat debug logs that your kibana dashboard configuration enabled or not while starting filebeat with debug mode.

Please check and share the debug logs if you still getting problem.

Regards,

1 Like
3

Hi both,

I've just started using the IIS module myself and noticed the dashboards are not configured/loaded into ES. The event data is going into ES just fine though, via LS.

When using the CLI to do the 'setup' of the dashboards, all dashboards seem to be there except the IIS one.

I used the chocolatey version of Filebeats 6.3 and so i thought it was to do with this, but even downloading the official version from elastic.co it appears to be the same issue.

Looking at the file structure of the filebeat zip that I downloaded there is no json file for IIS except in one place, let me explain:

In filebeat-6.3.0-windows-x86_64\kibana\6 there is no Filebeat-iis.json file, however in filebeat-6.3.0-windows-x86_64\kibana\default\6 there is a Filebeat-iis.json file. I've tried copying the file to the filebeat-6.3.0-windows-x86_64\kibana\6 directory and running setup again and although this time the dashboard appears in kibana none of the visualisations work with "could not locate index-patern-field" for each of the visualisations.

I think this is a bug but could someone confirm my findings first?

Thanks,

Michael

4

anyone at all? this appears to be a bug..

5

@if-meaton in the release 6.3.0 the templates were in the wrong directory, the fix will be present in 6.3.1, but if you move the dashboard manually it will work.

1 Like
6

Hi - yes i moved the file into the correct dir but then i got errors about index-pattern-fields.. I have other issues at the moment with tls and xpack so i'll have to come back to this..

Thank you for your help though!

7

Thanks for your help, I will wait for the patch then for further evaluation of the ELK-Stack for our project :slight_smile:

8

Copying Filebeat-iis.json dashboard from kibana\default\6 to kibana\6\dashboard worked for me. I re-ran filebeats.exe setup --dashboards and it ran without issue. I logged into kibana and the visualizations and dashboards were available.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.