Not Able to load template manually for logstach!

[SJN8 (Shashank Jain)]

Hi All ,

I am not able to load template manually from filebeat as i am using logstach as outpout .

getting below error :-

./filebeat -setup filebeat.template.json
Exiting: Dashboard loading requested but the Elasticsearch output is not configured/enabled

but in Docs it is mentioned , if logstach is used as o/p , then tempolate need to be loaded manually .

Also once templated are loaded , i can load sample dashboard .

please help me on the same asap .

[lara]

Hi,

Before anything, can you please tell me your Filebeat version?
I can answer you in case of the 5.6 version.

[SJN8 (Shashank Jain)]

Hi ,

below is my filebeat's version ,

filebeat version 5.6.3 (amd64), libbeat 5.6.3

[lara]

Hi,

https://www.elastic.co/guide/en/beats/filebeat/5.6/filebeat-template.html

if your Filebeat is installed on the same elasticsearch server, you can follow those instructions with no modification.
Otherwise, if you have your template on a remote machine, transfer the file filebeat.template.json to your server, change to directory where you had copy the file and load the template so (my elasticsearch server is a CentOs 7):

curl -H 'Content-Type: application/json' -XPUT 'http://localhost:9200/_template/filebeat' -d@filebeat.template.json

it should load the template into elasticsearch.
Check it in this way:

curl XGET 'localhost:9200/_cat/templates?v&s=name&pretty'

it should show you this output:

name template order version
filebeat filebeat-* 0

and confirm that the template "filebeat" is there.

I am new in this elastic world and I know that templates can also be referenced directly in other ways and configuration.
but the above example apparently worked for me.

let me know
lara

[lara]

please note:
the command is formatted strangely in my post, it all goes in one line, no interruption:

curl -H 'Content-Type: application/json' -XPUT 'http://localhost:9200/_template/filebeat' -d@filebeat.template.json

[SJN8 (Shashank Jain)]

Thanks Lara ,

i can see template is loaded , 'll get back to you in case of any other issue .

[SJN8 (Shashank Jain)]

Hi Lara ,

Template is loaded but facing issue while loading dashboard to Kibana ,

2017/11/22 06:43:41.482479 beat.go:625: CRIT Exiting: Error importing Kibana dashboards: fail to create the Elasticsearch loader: Elasticsearch output is not configured/enabled
Exiting: Error importing Kibana dashboards: fail to create the Elasticsearch loader: Elasticsearch output is not configured/enabled

i have mention required setting in filebeat and i am using filebeat-6.0.0 version .

[lara]

Hi,

On filebeat 6.0 I cannot help.

As for dashboards etc. I had used the standard that were mentioned here:

elastic/beats-dashboards

(follow instructions)
I do not know if now filebeat is shipped with up-to-date and targeted dashboards. As for Filebeat in general, I have not investigated those loaded dashboards yet.

Just a note:have you configured the logstash part output.conf ?
And also all input and filter required...

lara

[kvch (Noémi Ványi)]

Hi,

Unfortunately, Filebeat 6.0 is not able to load dashboards without configuring the Elasticsearch output.
In 6.1 a new option setup.dashboards.always_kibana is introduced to solve this problems.

If you cannot upgrade to 6.1, you could load them using the Kibana API:

curl --user <username>:<password> -XPOST localhost:5601/api/kibana/dashboards/import -H 'kbn-xsrf:true' -H 'Content-type:application/json' -d @./my-dashboards.json

If you don't use X-Pack, just emit the --user option.