Filebeat syslog fields are missing in Kibana

Elastic Stack Beats
1

Hi,

I am running ELK 6.2.4 (Elasticsearch, Kibana and Filebeat) on Centos 7. I see all the logs from /var/log/messages in Kibana "Discover" window, BUT for some reason the syslog fields are missing in the "available fields" list. Can you please point on a possible reason for that ?

I can supply any needed information, when in general I can say that all was configured by the book including:

  1. enabling system module
  2. filebeat setup
  3. ingest-geoip plugin installation

Looks like there is something basic that I am missing.

  • Please note that when running ELK on Ubuntu everything worked fine.

I will highly appreciate you assistance.

Thanks,
Yan

2

It might be that the field list in the Kibana index pattern needs to be updated. I would first try going to the management app (on the left nav) then clicking on "Index Patterns" under the Kibana subhead. From there click on the name of the index pattern. You should see a group of buttons in the top right hand corner of the screen that looks like:

image

Click the middle button to "refresh" the fields for that index pattern.

3

Ok, I tried that and got the following error:

image
image.png1721×173 19.3 KB

Any idea what this is about ?

Thanks

4

It looks like you're .kibana index is either "Read Only" or you don't have write permissions.

5

Ok, I restarted the ELK and eventually managed to do "refresh" per your example above without any errors, but the problem remains. syslog fields are not there.

I am open for any further suggestions.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.