# Filebeat OSQuery cannot locate index pattern

**URL:** <https://discuss.elastic.co/t/filebeat-osquery-cannot-locate-index-pattern/166290>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 30, 2019, 7:52am UTC](https://discuss.elastic.co/t/filebeat-osquery-cannot-locate-index-pattern/166290 "2019-01-30T07:52:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rcoundon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcoundon/32/30010_2.png) [@rcoundon](https://discuss.elastic.co/u/rcoundon)\
**Post date:** [January 30, 2019, 7:52am UTC](https://discuss.elastic.co/t/filebeat-osquery-cannot-locate-index-pattern/166290/1 "2019-01-30T07:52:11Z")

</div>

Using ElasticCloud 6.6.0 I'm trying to ship OSQuery data via Filebeat to Elasticstash.

On the machine with Filebeat I've set it up to connect to the Elastic Cloud Elasticsearch cluster and run "filebeat setup" where it tells me the dashboards are loaded correctly.

I can see in /var/log/filebeat/filebeat that data is being sent.

However, when I try to view the data in the Kibana OSQuery Compliance dashboard (note there's a small typo in the link on that page, it says Compilance instead of Compliance)  
I see the message:

Could not locate that index-pattern-field (id: osquery.result.columns.platform\_like) in each of the 1st three panes and then No Results Found in the rest.

What could be going on?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [January 30, 2019, 8:53am UTC](https://discuss.elastic.co/t/filebeat-osquery-cannot-locate-index-pattern/166290/2 "2019-01-30T08:53:58Z")

</div>

What index pattern have you set?

---

<div class="post-metadata">

**Author:** ![rcoundon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcoundon/32/30010_2.png) [@rcoundon](https://discuss.elastic.co/u/rcoundon)\
**Post date:** [January 30, 2019, 8:55am UTC](https://discuss.elastic.co/t/filebeat-osquery-cannot-locate-index-pattern/166290/3 "2019-01-30T08:55:29Z")

</div>

I haven't specifically set any index patterns for this as I thought that those were provided by the Filebeat setup and I don't know what the Dashboard is expecting. I couldn't see anything in the docs for that.

---

<div class="post-metadata">

**Author:** ![rcoundon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcoundon/32/30010_2.png) [@rcoundon](https://discuss.elastic.co/u/rcoundon)\
**Post date:** [January 30, 2019, 9:26pm UTC](https://discuss.elastic.co/t/filebeat-osquery-cannot-locate-index-pattern/166290/4 "2019-01-30T21:26:03Z")

</div>

Can you advise, what index patterns should I set?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2019, 9:26pm UTC](https://discuss.elastic.co/t/filebeat-osquery-cannot-locate-index-pattern/166290/5 "2019-02-27T21:26:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.