Filebeat OSQuery cannot locate index pattern

Elastic Stack Beats
1

Using ElasticCloud 6.6.0 I'm trying to ship OSQuery data via Filebeat to Elasticstash.

On the machine with Filebeat I've set it up to connect to the Elastic Cloud Elasticsearch cluster and run "filebeat setup" where it tells me the dashboards are loaded correctly.

I can see in /var/log/filebeat/filebeat that data is being sent.

However, when I try to view the data in the Kibana OSQuery Compliance dashboard (note there's a small typo in the link on that page, it says Compilance instead of Compliance)
I see the message:

Could not locate that index-pattern-field (id: osquery.result.columns.platform_like) in each of the 1st three panes and then No Results Found in the rest.

What could be going on?

2

What index pattern have you set?

3

I haven't specifically set any index patterns for this as I thought that those were provided by the Filebeat setup and I don't know what the Dashboard is expecting. I couldn't see anything in the docs for that.

4

Can you advise, what index patterns should I set?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.