Problem creating data views

Elastic Stack Kibana
1

to be able to use the predefined kibqnq dashboards for the nginx module while sending the log output of the nginx module from filbeat to logstash I specified the application of the pipeline in the elasticsearch output

// My logstash code here

input {
  beats {
    port => 5044
  }
}

filter {
  if [event][module] == "nginx" {
    mutate {
      remove_field => ["[event][original]"]
    }
    date {
      match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
      target => "@timestamp"
    }
  }
}

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => ["http://192.168.99.37:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      pipeline => "%{[@metadata][pipeline]}"
    }
  }
}

In my elasticsearch the index was created correctly with the mappings. To be able to use the predefined dashboards I executed the command sudo filebeat setup --dashboards and the default data view was created but when I try to go to the Discover section this is the error displayed

Capture d'écran 2024-10-28 102439
Capture d'écran 2024-10-28 102439621×362 54.5 KB

S'il vous plaît j'ai besoin d'aide

2

Hi @Michel_Gbeleou,

Welcome! You need to create the data view using Kibana UI or API as you can't create it in Logstash. But you should be able to specify an index pattern to match the indices you are creating with a wildcard as shown here which means you want need to keep recreating it.

Hope that helps!