I am struggling a bit with this. Windows 2019 running ELK 7.10.2. I have it ingesting filebeat, metricbeat, etc. Proper indices and patterns are present, except...
Logstash has an index, so I know its ingesting. However, I cannot create an index pattern for it and therefore cannot get visualizations from it. For the life of me, I cannot determine what the cause is.
If I run the Dev Tools, and query for the Indices, I get this:
yellow open heartbeat-7.10.1-2021.01.08-000001 pWcTBNz_TC6cJE3TWXq0kQ 1 1 157846 0 41.7mb 41.7mb
yellow open auditbeat-7.6.2-2021.01.13-000001 n4HJ_K7uQWGcKC6dU8zVlQ 1 1 58578 0 24.3mb 24.3mb
yellow open packetbeat-7.10.2-2021.01.26-000001 qvvqrrmaTuG8aSl-uV2ADw 1 1 247110 0 98mb 98mb
yellow open auditbeat-7.4.2-2021.01.11-000001 QQqfhtqnQQ-Z2qY1jxGIzA 1 1 90990 0 27mb 27mb
green open .apm-custom-link pHKByYwZQe6NgfwpizBSoQ 1 0 0 0 208b 208b
green open .kibana_task_manager_1 VvlWPKW2SfO2etrVOX1boQ 1 0 5 103 197.8kb 197.8kb
yellow open packetbeat-7.10.1-2021.01.08-000001 sspfA00VS5-q3MHTbxOpXA 1 1 19692468 0 5.7gb 5.7gb
yellow open auditbeat-7.10.2-2021.01.26-000001 8j1977n-SBaZUtG4STKJKQ 1 1 5583 0 4.1mb 4.1mb
green open .apm-agent-configuration tU8asT6uRD2Kw-b973mh5Q 1 0 0 0 208b 208b
yellow open winlogbeat-7.5.1-2021.01.11-000001 dD4CAdB1TOyxL8aqv9ZtDQ 1 1 60609 0 37.3mb 37.3mb
yellow open winlogbeat-7.10.2-2021.01.26-000001 i0YhH3OfToC8bVe8kMbaAA 1 1 144 0 377.4kb 377.4kb
green open .kibana_1 MCWUQhXjQjaDhFx8E1p9Cg 1 0 5003 83 3.4mb 3.4mb
yellow open %{[@metadata][beat]}-2021.01.26 SDG6ayapRmitkEjBj5o15A 1 1 1582368 0 505.4mb 505.4mb
yellow open metricbeat-7.10.2-2021.01.26-000001 4ulHLoZjRYOLvEWewNlLAw 1 1 10113 0 3.9mb 3.9mb
yellow open %{[@metadata][beat]}-2021.01.27 umN0E5aNSiyThAdN0-j5fw 1 1 118852 0 71.5mb 71.5mb
yellow open filebeat-7.10.1-2021.01.14-000002 DoAHhFDeTfS_jQXxyXE0Dw 1 1 91893900 0 36gb 36gb
yellow open filebeat-7.10.1-2021.01.13-000001 LnFBy2wmQEiVD0ZwiVDTAQ 1 1 130191084 0 50.4gb 50.4gb
yellow open logstash-2021.01.26-000001 8ykOajKwRmmYn4F8RPW4cw 1 1 1972265 0 592.9mb 592.9mb
yellow open winlogbeat-7.10.1-2021.01.08-000001 lr_OvA5TR1O_Qw6lwRieJg 1 1 48307537 0 41.8gb 41.8gb
yellow open heartbeat-7.5.1-2021.01.11-000001 ySFW6lcpSfqBG5FOJKZZZQ 1 1 136339 0 24.6mb 24.6mb
green open .kibana-event-log-7.10.1-000001 kzlvafLsR6aMzOzzrc1J3A 1 0 9 0 43.8kb 43.8kb
green open .async-search LhYO2-8DTq6L0CS-8qjLtg 1 0 0 0 3.4kb 3.4kb
yellow open heartbeat-7.10.2-2021.01.26-000001 7fCaa_J6SSuaqSYs6q8xWQ 1 1 703 0 526.7kb 526.7kb
green open .kibana-event-log-7.10.2-000001 UY6GdJcKS0GeftkPSoFrTg 1 0 2 0 11kb 11kb
yellow open metricbeat-7.10.1-2021.01.08-000001 chev6X7JTb6TDUnccSrPHQ 1 1 4365972 0 1.1gb 1.1gb
If I run this for the Index patterns:
#! Deprecation: this request accesses system indices: [.kibana_1], but in a future major version, direct access to system indices will be prevented by default
{
"took" : 23,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 5,
"relation" : "eq"
},
"max_score" : 5.5768394,
"hits" : [
{
"_index" : ".kibana_1",
"_type" : "_doc",
"_id" : "index-pattern:filebeat-",
"_score" : 5.5768394,
"_source" : {
"index-pattern" : {
"title" : "filebeat-"
}
}
},
{
"_index" : ".kibana_1",
"_type" : "_doc",
"_id" : "index-pattern:metricbeat-",
"_score" : 5.5768394,
"_source" : {
"index-pattern" : {
"title" : "metricbeat-"
}
}
},
{
"_index" : ".kibana_1",
"_type" : "_doc",
"_id" : "index-pattern:auditbeat-",
"_score" : 5.5768394,
"_source" : {
"index-pattern" : {
"title" : "auditbeat-"
}
}
},
{
"_index" : ".kibana_1",
"_type" : "_doc",
"_id" : "index-pattern:packetbeat-",
"_score" : 5.5768394,
"_source" : {
"index-pattern" : {
"title" : "packetbeat-"
}
}
},
{
"_index" : ".kibana_1",
"_type" : "_doc",
"_id" : "index-pattern:winlogbeat-",
"_score" : 5.5768394,
"_source" : {
"index-pattern" : {
"title" : "winlogbeat-"
}
}
}
]
}