# Filebeat index pattern

**URL:** https://discuss.elastic.co/t/filebeat-index-pattern/86837
**Category:** Beats
**Tags:** filebeat
**Created:** [May 23, 2017, 4:44pm UTC](https://discuss.elastic.co/t/filebeat-index-pattern/86837 "2017-05-23T16:44:00Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Bouali\_Inass](https://avatars.discourse-cdn.com/v4/letter/b/a88e4f/32.png) [@Bouali\_Inass](https://discuss.elastic.co/u/Bouali_Inass)
#### Post date: [May 23, 2017, 4:44pm UTC](https://discuss.elastic.co/t/filebeat-index-pattern/86837/1 "2017-05-23T16:44:00Z")

</div>

Hey i just installed a kibana and elasticsearch and logstash on a server and filebeat on a nother server that has apache logs and i wanna monitor those logs on kibana.  
I'm not sur what i've done is right ??  
the problem is that i wanna set filebeat index pattern on kibana and i couldnt do it cause i dont have create button on kiabana .

 ![](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2fcf80ede7e5b3dbed32c1572d455c9cdc547147.PNG)

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 24, 2017, 9:51am UTC](https://discuss.elastic.co/t/filebeat-index-pattern/86837/2 "2017-05-24T09:51:42Z")

</div>

Is there data in ES?  
Check with the `_cat/indices` request.

---

<div class="post-metadata">

### Author: ![Bouali\_Inass](https://avatars.discourse-cdn.com/v4/letter/b/a88e4f/32.png) [@Bouali\_Inass](https://discuss.elastic.co/u/Bouali_Inass)
#### Post date: [May 24, 2017, 1:00pm UTC](https://discuss.elastic.co/t/filebeat-index-pattern/86837/3 "2017-05-24T13:00:53Z")

</div>

this is what i get :  
yellow open filebeat-2017.05.23 TNrRmsF1SGisf7eWemk-Wg 5 1 3418 0 620.5kb 620.5kb  
yellow open .kibana 59ZfVxvERCqZd76r08h8wg 1 1 1 0 3.1kb 3.1kb

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 24, 2017, 11:08pm UTC](https://discuss.elastic.co/t/filebeat-index-pattern/86837/4 "2017-05-24T23:08:51Z")

</div>

Then all you need to do it change the index pattern to the right one 🙂

---

<div class="post-metadata">

### Author: ![Bouali\_Inass](https://avatars.discourse-cdn.com/v4/letter/b/a88e4f/32.png) [@Bouali\_Inass](https://discuss.elastic.co/u/Bouali_Inass)
#### Post date: [May 25, 2017, 10:27am UTC](https://discuss.elastic.co/t/filebeat-index-pattern/86837/5 "2017-05-25T10:27:27Z")

</div>

i dont have the create botton to create filebeat index pattern is there is any other way to do it ?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 25, 2017, 10:37am UTC](https://discuss.elastic.co/t/filebeat-index-pattern/86837/6 "2017-05-25T10:37:11Z")

</div>

You need to literally change the `logstash` to `filebeat` and you should be ok.

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [May 25, 2017, 1:11pm UTC](https://discuss.elastic.co/t/filebeat-index-pattern/86837/7 "2017-05-25T13:11:11Z")

</div>

If you follow this [step](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-index-pattern.html) from the Getting Started guide it will create the Kibana index pattern for you.

This is generally better than doing it yourself because the pattern setup by the tool has field formatters setup (like bytes get rendered as 1KB, percents as 99%, etc.). This may not affect Filebeat but definitely makes a difference with the other Beats.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 22, 2017, 1:19pm UTC](https://discuss.elastic.co/t/filebeat-index-pattern/86837/8 "2017-06-22T13:19:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
