Filebeat, nginx module dashboards are broken after migrate to 6.7

[jonviously]

Hi everyone !

I'm using the nginx module of filebeat with logstash.

After migrate from 6.6.1 to 6.7.1, the differents dashboards of the module were broken.

For Example the dashboard "[Filebeat Nginx] Overview" was like this :

After investigate, i found two things :

1. the is some mapping conflict on the index pattern "filebeat-*"

2. i got a template for "filebeat-6.6.1-*" but nothing for "filebeat-6.7.1-*"

I know the two points are link but i don't know how it happened and how i can fix it properly

[webmat (Mathieu Martin)]

Hi, you are right that this happens because you don't have the template for Filebeat 6.7.1.

The way to solve this is to run the setup command for Filebeat 6.7 as well. You should always run the setup command, every time you upgrade one of the Beats.

So a quick step by step:

From the command line:

filebeat setup

Then you need to delete the indices created without the template. From Kibana Dev Tools:

DELETE filebeat-6.7.1-*

After that you can start Filebeat again, and your dashboards should be fine again.

[webmat (Mathieu Martin)]

Forgot to mention: after you've deleted the incorrect index, you should go refresh the index pattern in Kibana. You should see all the conflicts go away

[jonviously]

Thank you for answering.

When i run filebeat setup i got this error :

Exiting: Template loading requested but the Elasticsearch output is not configured/enabled

This is because i got logstash output but not elasticsearch output. Furthermore, I already got setup.dashboards.enabled: true in filebeat.yml to skip this step, isn't it ? or it's only import dashboard into kibana ?

Is it possible to add the template through logstash ?

[jonviously]

up ?