# Precreated dashboards - no results found - different columns

**URL:** <https://discuss.elastic.co/t/precreated-dashboards-no-results-found-different-columns/87518>\
**Category:** Kibana\
**Created:** [May 30, 2017, 8:23am UTC](https://discuss.elastic.co/t/precreated-dashboards-no-results-found-different-columns/87518 "2017-05-30T08:23:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dacesilian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dacesilian/32/18614_2.png) [@Dacesilian](https://discuss.elastic.co/u/Dacesilian)\
**Post date:** [May 30, 2017, 8:23am UTC](https://discuss.elastic.co/t/precreated-dashboards-no-results-found-different-columns/87518/1 "2017-05-30T08:23:15Z")

</div>

Hello, I'm using Kibana 5.4.0 and I've imported dashboards with (filebeat util) `/usr/share/filebeat/scripts/import_dashboards` (it downloaded `beats-dashboards-5.4.0.zip`).

Problem is that fields in Elasticsearch (added with Logstash) are different than those in dashboards.  
I'm sending logs from clients with Filebeat, processing them with Logstash and saving into Elasticsearch.  
In Kibana I'm using `filebeat-*` mapping.

For example field system.syslog.hostname:

![](https://us1.discourse-cdn.com/elastic/original/3X/d/9/d9ad499b0914dd92bb572014e99dd8ccd0c83f5c.png)

but in index there is syslog\_hostname:

![](https://us1.discourse-cdn.com/elastic/original/3X/3/1/31c422671bd3f31e7a62af5becb59b774306c81a.png)

Dashboard are empty then (yes, I have 90 days ago selected so range is not problem):

 ![](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a980190a3d51a48048397f7d9992303b9705c7e3.png)

What should I do to have dashboards working? Thanks.

---

<div class="post-metadata">

**Author:** ![Heinmci](https://avatars.discourse-cdn.com/v4/letter/h/6a8cbe/32.png) [@Heinmci](https://discuss.elastic.co/u/Heinmci)\
**Post date:** [May 30, 2017, 8:28am UTC](https://discuss.elastic.co/t/precreated-dashboards-no-results-found-different-columns/87518/2 "2017-05-30T08:28:52Z")

</div>

Hi,  
Can't you simply rename the fields in the logstash filter so that they match those from the dashboard?  
For example :

```
filter {
  mutate {
    rename => { "syslog_hostname" => "[system][syslog][hostname]" }
  }
}

```

I'm not entirely sure on the nested syntax but I tihnk it would be something like this

---

<div class="post-metadata">

**Author:** ![Dacesilian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dacesilian/32/18614_2.png) [@Dacesilian](https://discuss.elastic.co/u/Dacesilian)\
**Post date:** [May 30, 2017, 8:58am UTC](https://discuss.elastic.co/t/precreated-dashboards-no-results-found-different-columns/87518/3 "2017-05-30T08:58:25Z")

</div>

I can rename them, yes, thank you for suggestion. But is it neccessary? Why are columns different? system.syslog.hostname is from filebeat documentation; why is it changed in logstash?

---

<div class="post-metadata">

**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\
**Post date:** [June 13, 2017, 8:47am UTC](https://discuss.elastic.co/t/precreated-dashboards-no-results-found-different-columns/87518/4 "2017-06-13T08:47:33Z")

</div>

I have similar issues, even with the correct hostnames.

I see all the available fields, I can see file beats actually pushing the syslog, but the dashboard shows nothing?

`June 13th 2017, 09:35:44.714	{ "@timestamp": "2017-06-13T08:35:44.714Z", "offset": 5970, "@version": "1", "input_type": "log", "beat": { "hostname": "ip-172-31-33-241", "name": "ip-172-31-33-241", "version": "5.4.0" }, "host": "ip-172-31-33-241", "source": "/var/log/syslog", "message": "Jun 13 08:35:44 ip-172-31-33-241 systemd[1]: Stopping filebeat...", "type": "log", "tags": [`

Then I load the dashboard, I get "No results found"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2017, 8:47am UTC](https://discuss.elastic.co/t/precreated-dashboards-no-results-found-different-columns/87518/5 "2017-07-11T08:47:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.