Kibana cannot locate index pattern osquery.result* for the filebeat-osquery combination

Elastic Stack Beats
1

Hi,

after filebeat and osquery setup data is present in the log-files and received from the Filebeat osquery module. However, I do not see any osquery.result* index pattern at all. Just activated the osquery module, nothing else.

Kibana dashboard error Message: Could not locate that index-pattern-field (id: osquery.result.columns.platform_like)

PS: "filebeat setup -e" does neither create an index pattern for osquery nor suricata enabled modules!

Any advise? How can I get or create the missing index pattern to make this work?

Regards, Gernot

2

What is your Filebeat version? Could you also share your configuration and debug logs?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.