Using ElasticCloud 6.6.0 I'm trying to ship OSQuery data via Filebeat to Elasticstash.
On the machine with Filebeat I've set it up to connect to the Elastic Cloud Elasticsearch cluster and run "filebeat setup" where it tells me the dashboards are loaded correctly.
I can see in /var/log/filebeat/filebeat that data is being sent.
However, when I try to view the data in the Kibana OSQuery Compliance dashboard (note there's a small typo in the link on that page, it says Compilance instead of Compliance)
I see the message:
Could not locate that index-pattern-field (id: osquery.result.columns.platform_like) in each of the 1st three panes and then No Results Found in the rest.
What could be going on?