# Filebeat-\* index can't be fetched in Kibana **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 30, 2016, 10:19am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593 "2016-11-30T10:19:10Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![asparadkar](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@asparadkar](https://discuss.elastic.co/u/asparadkar)\ **Post date:** [November 30, 2016, 10:19am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/1 "2016-11-30T10:19:10Z")
I'm trying to send a log file. FB--\>ES--\>Kibana. All the configurations are done.When i try for filebeat-\* index pattern in kibana,it can't fetch the mapping.The screen is like this ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f932c20765997e6387af27368fc8dea1c182455b.JPG) Can you suggest a solution to this? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 30, 2016, 10:21am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/2 "2016-11-30T10:21:49Z")
Do you have any indices in Elasticsearch that matches the `filebeat-*` pattern? ---
**Author:** ![asparadkar](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@asparadkar](https://discuss.elastic.co/u/asparadkar)\ **Post date:** [November 30, 2016, 10:23am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/3 "2016-11-30T10:23:10Z")
No.. I haven't created any. How do i check for the same? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 30, 2016, 10:24am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/4 "2016-11-30T10:24:08Z")
You need to index some data to get the indices created, which should resolve the issue. ---
**Author:** ![asparadkar](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@asparadkar](https://discuss.elastic.co/u/asparadkar)\ **Post date:** [November 30, 2016, 10:25am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/5 "2016-11-30T10:25:32Z")
how do i do that? can you please help me with this? currently when i do GET /\_cat/indices?v this is what i get health status index uuid pri rep docs.count docs.deleted store.size pri.store.size yellow open .monitoring-kibana-2-2016.11.29 RHJ508yuTM63FMPc3NGUeQ 1 1 3719 0 817.3kb 817.3kb yellow open .monitoring-kibana-2-2016.11.28 RA\_2KqZZQEyMhZQ5Rv2fsQ 1 1 3684 0 761.7kb 761.7kb yellow open .kibana 4blvngEtS2GQ9CqxHBPM3w 1 1 12 2 109kb 109kb yellow open .monitoring-kibana-2-2016.11.30 sKHiSdtyQqWkvriNUorStw 1 1 2795 0 569.5kb 569.5kb yellow open .monitoring-kibana-2-2016.11.21 8WmsFxuJT6iyBJBpPiX09g 1 1 1734 0 465.7kb 465.7kb yellow open my-index gztHHJqSQKenNsotULctXg 5 1 1 0 3.9kb 3.9kb yellow open .monitoring-es-2-2016.11.22 4id5-NxwTO6zsBKUD8tUSw 1 1 23272 64 9.7mb 9.7mb yellow open .reporting-2016.11.20 5S-sBhbcRfmgwt5XwAYE0w 5 1 1 0 213kb 213kb yellow open .monitoring-es-2-2016.11.24 u7Kn6HpwQ2uE7ENxoSH2Qg 1 1 31411 180 13.5mb 13.5mb yellow open .monitoring-kibana-2-2016.11.24 4DPc2bRyR-aSWXEvMALonQ 1 1 3774 0 843.9kb 843.9kb yellow open .monitoring-es-2-2016.11.21 UAT3Z9a9RfmO8Qu7M-7Q1g 1 1 9286 126 4.1mb 4.1mb yellow open .monitoring-es-2-2016.11.28 jeBrGjLKRDSnnRvEIpg31w 1 1 36337 352 16.3mb 16.3mb yellow open .monitoring-es-2-2016.11.29 OeWv5HVsShK2zWO-oA1NGw 1 1 41524 96 17.4mb 17.4mb yellow open .monitoring-kibana-2-2016.11.25 kx\_te3sOTw6K7DyPrUbhLQ 1 1 1150 0 274.7kb 274.7kb yellow open .monitoring-data-2 FFiCFcWGQueHjioLi9puKQ 1 1 3 0 11.4kb 11.4kb yellow open .monitoring-kibana-2-2016.11.22 qlA38y0RT\_uKtL-6zxYNjQ 1 1 2916 0 634.6kb 634.6kb yellow open .monitoring-es-2-2016.11.25 35M-gyX9SDODRJ5O\_2ApwA 1 1 19746 0 8.5mb 8.5mb yellow open .monitoring-es-2-2016.11.30 fQKHSr7iQuqbx9G5-8ZgkQ 1 1 33346 0 14.9mb 14.9mb ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 30, 2016, 10:33am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/6 "2016-11-30T10:33:43Z")
Try to get Filebeat to start indexing into Elasticsearch, assuming it is configured to use that index pattern. ---
**Author:** ![asparadkar](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@asparadkar](https://discuss.elastic.co/u/asparadkar)\ **Post date:** [November 30, 2016, 10:36am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/7 "2016-11-30T10:36:36Z")
how do i get filebeat to start indexing into elasticsearch? i can share the yml files if you want... ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [November 30, 2016, 11:11am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/8 "2016-11-30T11:11:02Z")
Please share your filebeat config file and the filebeat logs. ---
**Author:** ![asparadkar](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@asparadkar](https://discuss.elastic.co/u/asparadkar)\ **Post date:** [November 30, 2016, 11:20am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/9 "2016-11-30T11:20:15Z")
###################### Filebeat Configuration Example ######################### # This file is an example configuration file highlighting only the most common # options. The filebeat.full.yml file from the same directory contains all the # supported options with more comments. You can use it as a reference. # # You can find the full configuration reference here: # [https://www.elastic.co/guide/en/beats/filebeat/index.html](https://www.elastic.co/guide/en/beats/filebeat/index.html) #=========================== Filebeat prospectors ============================= filebeat.prospectors: # Each - is a prospector. Most options can be set at the prospector level, so # you can use different prospectors for various configurations. # Below are the prospector specific configurations. - input\_type: log #================================ General ===================================== # The name of the shipper that publishes the network data. It can be used to group # all the transactions sent by a single shipper in the web interface. #name: # The tags of the shipper are included in their own field with each # transaction published. #tags: ["service-X", "web-tier"] # Optional fields that you can specify to add additional information to the # output. #fields: # env: staging #================================ Outputs ===================================== # Configure what outputs to use when sending the data collected by the beat. # Multiple outputs may be used. #-------------------------- Elasticsearch output ------------------------------ output.elasticsearch: # Array of hosts to connect to. hosts: ["localhost:9200"] #[template.name](http://template.name) : "filebeat" #template.path : "C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\software\_ELK\Filebeat\filebeat.template.json" #template.overwrite : true # Optional protocol and basic auth credentials. #protocol: "https" #username: "elastic" #password: "changeme" #----------------------------- Logstash output -------------------------------- #output.logstash: # The Logstash hosts #hosts: ["localhost:5044"] #protocol: "http" # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications #ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"] # Certificate for SSL client authentication #ssl.certificate: "/etc/pki/client/cert.pem" # Client Certificate Key #ssl.key: "/etc/pki/client/cert.key" #================================ Logging ===================================== # Sets log level. The default log level is info. # Available log levels are: critical, error, warning, info, debug #logging.level: debug # At debug level, you can selectively enable logging only for some components. # To enable all selectors use ["\*"]. Examples of other selectors are "beat", # "publish", "service". #logging.selectors: ["\*"] ---
**Author:** ![asparadkar](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@asparadkar](https://discuss.elastic.co/u/asparadkar)\ **Post date:** [November 30, 2016, 11:23am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/10 "2016-11-30T11:23:24Z")
2016-11-30T11:10:27+05:30 INFO Home path: [C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\software\_ELK\Filebeat] Config path: [C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\software\_ELK\Filebeat] Data path: [C:\ProgramData\filebeat] Logs path: [C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\software\_ELK\Filebeat\logs] 2016-11-30T11:10:27+05:30 INFO Setup Beat: filebeat; Version: 5.0.1 2016-11-30T11:10:27+05:30 INFO Loading template enabled. Reading template file: C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\software\_ELK\Filebeat\filebeat.template.json 2016-11-30T11:10:27+05:30 INFO Loading template enabled for Elasticsearch 2.x. Reading template file: C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\software\_ELK\Filebeat\filebeat.template-es2x.json 2016-11-30T11:10:27+05:30 INFO Elasticsearch url: [http://localhost:9200](http://localhost:9200) 2016-11-30T11:10:27+05:30 INFO Activated elasticsearch as output plugin. 2016-11-30T11:10:27+05:30 INFO Publisher name: 3INLAPARADKA 2016-11-30T11:10:27+05:30 INFO Flush Interval set to: 1s 2016-11-30T11:10:27+05:30 INFO Max Bulk Size set to: 50 2016-11-30T11:10:27+05:30 INFO filebeat start running. 2016-11-30T11:10:27+05:30 INFO Registry file set to: C:\ProgramData\filebeat\registry 2016-11-30T11:10:27+05:30 INFO Loading registrar data from C:\ProgramData\filebeat\registry 2016-11-30T11:10:27+05:30 INFO States Loaded from registrar: 0 2016-11-30T11:10:27+05:30 INFO Loading Prospectors: 1 2016-11-30T11:10:27+05:30 INFO Starting Registrar 2016-11-30T11:10:27+05:30 INFO Load previous states from registry into memory 2016-11-30T11:10:27+05:30 INFO Previous states loaded: 0 2016-11-30T11:10:27+05:30 INFO Start sending events to output 2016-11-30T11:10:27+05:30 INFO Starting spooler: spool\_size: 2048; idle\_timeout: 5s 2016-11-30T11:10:27+05:30 INFO Loading Prospectors completed. Number of prospectors: 1 2016-11-30T11:10:27+05:30 INFO All prospectors are initialised and running with 0 states to persist 2016-11-30T11:10:27+05:30 INFO Starting prospector of type: log 2016-11-30T11:10:27+05:30 INFO Harvester started for file: C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\RDS69\_PAD32\_PRB46\_F1\_WEU\_Iteration1.log 2016-11-30T11:10:32+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:10:33+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:10:35+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized ---
**Author:** ![asparadkar](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@asparadkar](https://discuss.elastic.co/u/asparadkar)\ **Post date:** [November 30, 2016, 11:24am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/11 "2016-11-30T11:24:37Z")
2016-11-30T11:10:27+05:30 INFO Home path: [C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\software\_ELK\Filebeat] Config path: [C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\software\_ELK\Filebeat] Data path: [C:\ProgramData\filebeat] Logs path: [C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\software\_ELK\Filebeat\logs] 2016-11-30T11:10:27+05:30 INFO Setup Beat: filebeat; Version: 5.0.1 2016-11-30T11:10:27+05:30 INFO Loading template enabled. Reading template file: C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\software\_ELK\Filebeat\filebeat.template.json 2016-11-30T11:10:27+05:30 INFO Loading template enabled for Elasticsearch 2.x. Reading template file: C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\software\_ELK\Filebeat\filebeat.template-es2x.json 2016-11-30T11:10:27+05:30 INFO Elasticsearch url: [http://localhost:9200](http://localhost:9200) 2016-11-30T11:10:27+05:30 INFO Activated elasticsearch as output plugin. 2016-11-30T11:10:27+05:30 INFO Publisher name: 3INLAPARADKA 2016-11-30T11:10:27+05:30 INFO Flush Interval set to: 1s 2016-11-30T11:10:27+05:30 INFO Max Bulk Size set to: 50 2016-11-30T11:10:27+05:30 INFO filebeat start running. 2016-11-30T11:10:27+05:30 INFO Registry file set to: C:\ProgramData\filebeat\registry 2016-11-30T11:10:27+05:30 INFO Loading registrar data from C:\ProgramData\filebeat\registry 2016-11-30T11:10:27+05:30 INFO States Loaded from registrar: 0 2016-11-30T11:10:27+05:30 INFO Loading Prospectors: 1 2016-11-30T11:10:27+05:30 INFO Starting Registrar 2016-11-30T11:10:27+05:30 INFO Load previous states from registry into memory 2016-11-30T11:10:27+05:30 INFO Previous states loaded: 0 2016-11-30T11:10:27+05:30 INFO Start sending events to output 2016-11-30T11:10:27+05:30 INFO Starting spooler: spool\_size: 2048; idle\_timeout: 5s 2016-11-30T11:10:27+05:30 INFO Loading Prospectors completed. Number of prospectors: 1 2016-11-30T11:10:27+05:30 INFO All prospectors are initialised and running with 0 states to persist 2016-11-30T11:10:27+05:30 INFO Starting prospector of type: log 2016-11-30T11:10:27+05:30 INFO Harvester started for file: C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\RDS69\_PAD32\_PRB46\_F1\_WEU\_Iteration1.log 2016-11-30T11:10:32+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:10:33+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:10:35+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:10:39+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:10:47+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:10:57+05:30 INFO Non-zero metrics in the last 30s: filebeat.harvester.started=1 libbeat.es.publish.read\_bytes=1965 libbeat.publisher.published\_events=836 filebeat.harvester.running=1 filebeat.harvester.open\_files=1 libbeat.es.publish.write\_bytes=605 2016-11-30T11:11:03+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:11:27+05:30 INFO Non-zero metrics in the last 30s: libbeat.es.publish.read\_bytes=393 libbeat.es.publish.write\_bytes=121 2016-11-30T11:11:35+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:11:57+05:30 INFO Non-zero metrics in the last 30s: libbeat.es.publish.read\_bytes=393 libbeat.es.publish.write\_bytes=121 2016-11-30T11:12:27+05:30 INFO No non-zero metrics in the last 30s 2016-11-30T11:12:35+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:12:57+05:30 INFO Non-zero metrics in the last 30s: libbeat.es.publish.read\_bytes=393 libbeat.es.publish.write\_bytes=121 2016-11-30T11:13:27+05:30 INFO No non-zero metrics in the last 30s 2016-11-30T11:13:35+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:13:57+05:30 INFO Non-zero metrics in the last 30s: libbeat.es.publish.read\_bytes=393 libbeat.es.publish.write\_bytes=121 2016-11-30T11:14:27+05:30 INFO No non-zero metrics in the last 30s 2016-11-30T11:14:35+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:14:57+05:30 INFO Non-zero metrics in the last 30s: libbeat.es.publish.read\_bytes=393 libbeat.es.publish.write\_bytes=121 2016-11-30T11:15:27+05:30 INFO No non-zero metrics in the last 30s 2016-11-30T11:15:32+05:30 INFO File is inactive: C:\Here\CMST-1932-EPT\_Monitoring\_mechanism\_and\_Error\_Handling\RDS69\_PAD32\_PRB46\_F1\_WEU\_Iteration1.log. Closing because close\_inactive of 5m0s reached. 2016-11-30T11:15:36+05:30 ERR Connecting error publishing events (retrying): 401 Unauthorized 2016-11-30T11:15:57+05:30 INFO Non-zero metrics in the last 30s: filebeat.harvester.closed=1 libbeat.es.publish.read\_bytes=393 filebeat.harvester.running=-1 filebeat.harvester.open\_files=-1 libbeat.es.publish.write\_bytes=121 2016-11-30T11:16:27+05:30 INFO No non-zero metrics in the last 30s ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [December 1, 2016, 8:50am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/12 "2016-12-01T08:50:58Z")
> [@asparadkar](#): > > Connecting error publishing events (retrying): 401 Unauthorized Looks like elasticsearch needs username / password but you didn't configure any. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 29, 2016, 8:50am UTC](https://discuss.elastic.co/t/filebeat-index-cant-be-fetched-in-kibana/67593/13 "2016-12-29T08:50:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.