I have installed the ELK Stack with the following configurations,
Elastic search - 5.6.8
Logstash - 5.6.8
Kibana - 5.6.8
Packet Beat in Clients - 6.2.2
I have installed the X-Pack with the free license for one year in kibana AWA in elastic search.
I have configured the packet beat to push the logs to the elasticSearch server and every logs are loging correctly and visible from the DISCOVER panel. But when I try to create the Dashboard or visualisation for the packet beat logs, its prompting the following error,
"Could not locate that index-pattern (id: packetbeat-*), click here to re-create it"
Tried twice by deleting the existing index and re-creating the index for packetbeat,but of no-use.
Request to please advice if anything is missing. Also I have installed the default packetbeat dashboards pack (" beats-dashboards-1.3.1").
Thanks in advance
Hi Vishnu, I think you may be using the wrong dashboards for Packet Beat. Since 6.0, the dashboards are bundled with the Beat package, so you don't need a separate zip file. Take a look at the Packetbeat Getting Started Guide, specifically the step for loading Kibana dashboards.
Hope this helps,
@cjcenizal Thank you for the reply. Yes. I just upgraded the kibana and ES to 6.x versions. But while installing the X Pack it's taking more than 30 minutes. And the installation was not completed as I broke the process.
Another thing is related with the packetbeat Dashboard. While using the packetbeat Dashboard again it's prompting the ("id: packetbeat") is not found!!! But the Discover table is showing logs still. IAM not able to visualise.
Thanks is advance.
Hi Vishnu, you mentioned that the installation was not completed. It's recommended that you complete the installation. Can you confirm the name of the dashboard you're looking at?
@cjcenizal Thank you for the reply! Installation is completed. I was working on the packetbeat and metricbeat Dashbboard. The logging is working. The metricbeat is working OK.
I have configured MetricBeat and Packetbeat.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.