HELP! Unable to fetch mapping. Do you have indices matching the pattern?

Elastic Stack Kibana
1

Hey everyone!

I'm working on a complete Beats build. Unfortunately, I can't get past the following error in Kibana:

"Unable to fetch mapping. Do you have indices matching the pattern?"

I'm driving everything through Logstash and I've even tried the manual index load to no avail - it just doesn't seem to stick.

I've followed just about every tutorial out there and I keep getting stuck here. I'd appreciate any tips/pointers from the experts out there.

For reference, I'm using everything 5.5.

Thanks for help!
-BE

2

Do you have any data loaded into Elasticsearch? Check this by accessing the URL http://localhost:9200/_cat/indices. Change localhost to the IP of your elasticsearch instance (if you are not running everything locally). Do you see your index in the results? Can the server running your kibana instance execute the same URL?

Did you change the Elasticsearch port? The default is 9200. If this changed than the kibana configuration file will need to be updated to the new value.

If you have data loaded in Elasticsearch and the machine running kibana can access Elasticsearch then kibana should be able to access the index pattern. Enter the index name into the Index name or pattern field.

3

So, I was able to get data into ELK with Packetbeat - using the following steps:

  1. Manually load the index.
  2. Import the Packetbeat dashboards (using the script)
  3. Configuring the packetbeat.yml as such:

output.elasticsearch:

Array of hosts to connect to.

hosts: ["localhost:9200"]
template.name: "packetbeat"
template.path: "packetbeat.template.json"
template.overwrite: true

output.logstash:

The Logstash hosts

hosts: ["localhost:5044"]

Data - yay! :slight_smile:

So, I tried to follow the same process (above) with metricbeat... results:
a) the dashboards deploy
b) the metricbeat-* index shows in the Index Patterns, but I still get the errpr: No matching indices found: No indices match pattern "metricbeat-*"

I feel like I'm missing a step to close the deal - what am I missing?

Thanks,
Brad

4

An additional point of info: looking at the indices in DEV, here is what I see:

yellow open .kibana V83p8NlHRRuUb6Kk4PQsXQ 1 1 279 149 473.2kb 473.2kb
yellow open packetbeat-2017.09.15 _tshFpkeRyWtEgoWviy0uw 5 1 29189 0 23mb 23mb
yellow open packetbeat-2017.09.14 C2iX-4fQQ6-v0onDel-yyQ 5 1 10520 0 4.8mb 4.8mb

-Brad

5

Another log dump from Kibana:
Error: No matching indices found: No indices match pattern "metricbeat-*"
KbnError@http://localhost:5601/bundles/commons.bundle.js?v=15523:92:13713
IndexPatternMissingIndices@http://localhost:5601/bundles/commons.bundle.js?v=15523:92:19337
request/<@http://localhost:5601/bundles/kibana.bundle.js?v=15523:227:19693
processQueue@http://localhost:5601/bundles/commons.bundle.js?v=15523:38:23621
scheduleProcessQueue/<@http://localhost:5601/bundles/commons.bundle.js?v=15523:38:23888
$eval@http://localhost:5601/bundles/commons.bundle.js?v=15523:39:4607
$digest@http://localhost:5601/bundles/commons.bundle.js?v=15523:39:2343
$apply@http://localhost:5601/bundles/commons.bundle.js?v=15523:39:5026
done@http://localhost:5601/bundles/commons.bundle.js?v=15523:37:25016
completeRequest@http://localhost:5601/bundles/commons.bundle.js?v=15523:37:28702
createHttpBackend/</xhr.onload@http://localhost:5601/bundles/commons.bundle.js?v=15523:37:29634

It is not evident to me what I'm missing. It would be great if there was a step-by-step when you run into this type of issue. Thanks for everyone's assistance.

BE

6

Additionally, when I execute a manual upload, here is what I get:

root@ubuntu:/# curl -H 'Content-Type: application/json' -XP9200/_template/metricbeat' -d@/etc/metricbeat/metricbeat.template.json
{"acknowledged":true}

So, in theory, the index is loaded? I should be able to move forward from there. Unfortunately, no. The index does not show up in Kibana. Thoughts?

BE

7

So, I figured out the process to get indexes to load. On to integrating logs via filebeat locally with logstash. I will post my process & findings when done.

Cheers,
BE

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.