Help with getting dashboard to show data from firewall


(Conan) #1

I am getting this error on objects loaded in dashboard.

Could not locate that index-pattern (id: d38eee00-2ec7-11e9-bbeb-83fc1903766e), click here to re-create it

These are the guides that I followed to get to this point in trying to view firewall syslog data.
https://github.com/sm-biz/paloalto-elasticstack-viz/blob/master/README.md
https://github.com/shadow-box/Palo-Alto-Networks-ELK-Stack/tree/master/Visualizations

In the guide it says to create index patterns, but they do not seem to have any effect on the dashboard objects. I have included some data that may help with seeing a problem and I can add more if needed. Just tell me what you think would help. I am pretty sure I am doing something wrong, but I have no idea what at this point. I have a few other index patterns that are working.

root@boe-elastic:<del># curl localhost:9200/.kibana/_search?pretty -H 'Content-Type: application/json' -d'{"size":9999}' -s | grep -i "index-pattern"
"_id" : "index-pattern:filebeat- <em>",
"index-pattern" : {
"type" : "index-pattern",
"index-pattern" : "6.5.0"
"_id" : "index-pattern:1738b650-2fcb-11e9-951c-1dc3ddbe38dc",
"index-pattern" : {
"type" : "index-pattern",
"index-pattern" : "6.5.0"
"_id" : "index-pattern:21a83890-2fcb-11e9-951c-1dc3ddbe38dc",
"index-pattern" : {
"type" : "index-pattern",
"index-pattern" : "6.5.0"
"_id" : "index-pattern:elastiflow-</em> ",
"index-pattern" : {
"type" : "index-pattern",
"index-pattern" : "6.5.0"
"_id" : "index-pattern:0e5af7a0-2fcb-11e9-951c-1dc3ddbe38dc",
"index-pattern" : {
"type" : "index-pattern",
"index-pattern" : "6.5.0"
"_id" : "index-pattern:03200f10-2fcb-11e9-951c-1dc3ddbe38dc",
"index-pattern" : {
"type" : "index-pattern",
"index-pattern" : "6.5.0"

root@boe-elastic:# systemctl status kibana
kibana.service - Kibana
Loaded: loaded (/etc/systemd/system/kibana.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2019-02-13 09:33:29 EST; 6h ago
Main PID: 2632 (node)
Tasks: 22 (limit: 4915)
CGroup: /system.slice/kibana.service
├─ 2632 /usr/share/kibana/bin/../node/bin/node --no-warnings /usr/share/kibana/bin/../src/cli -c /etc/kibana/kibana.yml
└─29527 /usr/share/kibana/node/bin/node --no-warnings /usr/share/kibana/src/legacy/core_plugins/interpreter/server/lib/route_expression/thread/babeled.js

Feb 13 15:40:34 boe-elastic kibana[2632]: {"type":"response","[@timestamp](https://github.com/timestamp)":"2019-02-13T20:40:34Z","tags":[],"pid":2632,"method":"post","statusCode":200,"req":{"url":"/api/index_management/indices/reload","method":"pos
Feb 13 15:41:04 boe-elastic kibana[2632]: {"type":"response","[@timestamp](https://github.com/timestamp)":"2019-02-13T20:41:04Z","tags":[],"pid":2632,"method":"post","statusCode":200,"req":{"url":"/api/index_management/indices/reload","method":"pos
Feb 13 15:41:34 boe-elastic kibana[2632]: {"type":"response","[@timestamp](https://github.com/timestamp)":"2019-02-13T20:41:34Z","tags":[],"pid":2632,"method":"post","statusCode":200,"req":{"url":"/api/index_management/indices/reload","method":"pos
Feb 13 15:42:04 boe-elastic kibana[2632]: {"type":"response","[@timestamp](https://github.com/timestamp)":"2019-02-13T20:42:04Z","tags":[],"pid":2632,"method":"post","statusCode":200,"req":{"url":"/api/index_management/indices/reload","method":"pos
Feb 13 15:42:34 boe-elastic kibana[2632]: {"type":"response","[@timestamp](https://github.com/timestamp)":"2019-02-13T20:42:34Z","tags":[],"pid":2632,"method":"post","statusCode":200,"req":{"url":"/api/index_management/indices/reload","method":"pos
Feb 13 15:43:04 boe-elastic kibana[2632]: {"type":"response","[@timestamp](https://github.com/timestamp)":"2019-02-13T20:43:04Z","tags":[],"pid":2632,"method":"post","statusCode":200,"req":{"url":"/api/index_management/indices/reload","method":"pos
Feb 13 15:43:34 boe-elastic kibana[2632]: {"type":"response","[@timestamp](https://github.com/timestamp)":"2019-02-13T20:43:34Z","tags":[],"pid":2632,"method":"post","statusCode":200,"req":{"url":"/api/index_management/indices/reload","method":"pos
Feb 13 15:44:02 boe-elastic kibana[2632]: {"type":"response","[@timestamp](https://github.com/timestamp)":"2019-02-13T20:44:02Z","tags":[],"pid":2632,"method":"get","statusCode":200,"req":{"url":"/api/saved_objects/_find?type=index-pattern&amp;per_page
Feb 13 15:44:02 boe-elastic kibana[2632]: {"type":"response","[@timestamp](https://github.com/timestamp)":"2019-02-13T20:44:02Z","tags":[],"pid":2632,"method":"post","statusCode":200,"req":{"url":"/api/saved_objects/_bulk_get","method":"post","head
Feb 13 15:44:02 boe-elastic kibana[2632]: {"type":"response","[@timestamp](https://github.com/timestamp)":"2019-02-13T20:44:02Z","tags":[],"pid":2632,"method":"post","statusCode":200,"req":{"url":"/api/saved_objects/_bulk_get","method":"post","head

root@boe-elastic:# curl -XGET 'http://localhost:9200'

"name" : "D5XC-Bz",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "4dd-kZXfQnyHPYS_95o0wQ",
"version" : {
"number" : "6.6.0",
"build_flavor" : "default",
"build_type" : "deb",
"build_hash" : "a9861f4",
"build_date" : "2019-01-24T11:27:09.439740Z",
"build_snapshot" : false,
"lucene_version" : "7.6.0",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"
"tagline" : "You Know, for Search"

root@boe-elastic:</del># curl -XGET http://localhost:5601/status -I
HTTP/1.1 200 OK
kbn-name: kibana
kbn-xpack-sig: d069ddb4aa78394f9f58851c032108d3
cache-control: no-cache
content-type: text/html; charset=utf-8
content-length: 72706
vary: accept-encoding
accept-ranges: bytes
connection: close
Date: Wed, 13 Feb 2019 20:49:11 GMT

root@boe-elastic:~# curl -I http://localhost:5601/status
HTTP/1.1 200 OK
kbn-name: kibana
kbn-xpack-sig: d069ddb4aa78394f9f58851c032108d3
cache-control: no-cache
content-type: text/html; charset=utf-8
content-length: 72706
vary: accept-encoding
connection: close
Date: Wed, 13 Feb 2019 20:49:58 GMT

Any additional context:


(Mark Walkom) #2

Do you mind please editing your post and wrapping things like code/logs in either markdown backticks, or use the </> button to format them.

It makes it heaps easier to read and debug :slight_smile:


(Conan) #3

Sorry I started this on my phone. Hopefully it is a little better. If not I can fix it in the morning.