# Unable to create a Kibana Index pattern

**URL:** <https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005>\
**Category:** Kibana\
**Created:** [January 23, 2021, 8:03pm UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005 "2021-01-23T20:03:33Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maria\_Elle](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@Maria\_Elle](https://discuss.elastic.co/u/Maria_Elle)\
**Post date:** [January 23, 2021, 8:03pm UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005/1 "2021-01-23T20:03:33Z")

</div>

I am using an Ubuntu machine, and I have just finished downloading all of ELK onto it, I now want to create a Kibana Index pattern with Filebeat but it is not allowing me to do so. How can I fix this issue or find out why it's happening? Thank you!

 ![Screen Shot 2021-01-23 at 2.59.20 PM](https://us1.discourse-cdn.com/elastic/original/3X/a/2/a21e49562b03c8ed66a4f00094cd9e8cd324a69b.jpeg) .

---

<div class="post-metadata">

**Author:** ![LizaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizad/32/51074_2.png) [@LizaD](https://discuss.elastic.co/u/LizaD)\
**Post date:** [January 23, 2021, 9:39pm UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005/2 "2021-01-23T21:39:37Z")

</div>

Hi @Maria_Elle,

Can you check to see filebeat is running and connected successfully to elasticsearch?

Thanks,  
Liza

---

<div class="post-metadata">

**Author:** ![Maria\_Elle](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@Maria\_Elle](https://discuss.elastic.co/u/Maria_Elle)\
**Post date:** [January 23, 2021, 9:55pm UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005/3 "2021-01-23T21:55:49Z")

</div>

Hi, I checked the status of filbeat, as shown in the screenshot below, it seems like it is running.

Thank you for helping.

 ![Screen Shot 2021-01-23 at 4.51.47 PM](https://us1.discourse-cdn.com/elastic/original/3X/e/d/edd7f52eceb1825ec45a1d740b2368c84c930294.png)

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [January 23, 2021, 10:21pm UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005/4 "2021-01-23T22:21:36Z")

</div>

These does not mean data is being reach to elastic cluster and saved as index. this means daemon filebeat is running.

what is your filebeat.yml file on output section. are you directly sending to elk node?

---

<div class="post-metadata">

**Author:** ![Maria\_Elle](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@Maria\_Elle](https://discuss.elastic.co/u/Maria_Elle)\
**Post date:** [January 23, 2021, 10:40pm UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005/5 "2021-01-23T22:40:00Z")

</div>

Okay I understand, I am very new to ELK and currently trying to learn how to input a log file into Elasticsearch.

Right now this is what my filebeat.yml looks like for output. Do I need to configure it another way so it is communicating correctly to Elasticsearch?

Thank you so much for your help!

 ![Screen Shot 2021-01-23 at 5.38.38 PM](https://us1.discourse-cdn.com/elastic/original/3X/3/4/348fe3a818714b657a3f441400a572971252cb76.jpeg)

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [January 23, 2021, 10:52pm UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005/6 "2021-01-23T22:52:53Z")

</div>

do you have setup any kind of login in to kibana/elk? if yes you have to enable  
username  
password

default login is elastic:changeme

run this from your command line

curl -XGET localhost:9200/\_cluster/health?pretty

{  
"cluster\_name" : "mycluster-1",  
"status" : "green",  
"timed\_out" : false,  
"number\_of\_nodes" : 1,  
"number\_of\_data\_nodes" : 1,  
"active\_primary\_shards" : 21,  
"active\_shards" : 40,  
"relocating\_shards" : 0,  
"initializing\_shards" : 0,  
"unassigned\_shards" : 0,  
"delayed\_unassigned\_shards" : 0,  
"number\_of\_pending\_tasks" : 0,  
"number\_of\_in\_flight\_fetch" : 0,  
"task\_max\_waiting\_in\_queue\_millis" : 0,  
"active\_shards\_percent\_as\_number" : 100.0  
}

then it is without password.  
if you need password you do

curl -u elastic:changeme localhost:9200/\_cluster/health?pretty

---

<div class="post-metadata">

**Author:** ![Maria\_Elle](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@Maria\_Elle](https://discuss.elastic.co/u/Maria_Elle)\
**Post date:** [January 23, 2021, 11:13pm UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005/7 "2021-01-23T23:13:38Z")

</div>

I do believe I have a username and a password that I created before when I was installing nginx. I used this command, changed the username at the end and entered a password when it prompted me to. `sudo htpasswd -c /etc/nginx/htpasswd.users kibanaadmin`

Below is the output of the first command you suggested. How can I enable the username/password?

Again, thank you very much for the help!

 ![Screen Shot 2021-01-23 at 6.07.30 PM](https://us1.discourse-cdn.com/elastic/original/3X/9/9/99a90d631a643fcaebcfa88776a9e5a2b55493c1.jpeg)

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [January 24, 2021, 1:19am UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005/8 "2021-01-24T01:19:39Z")

</div>

Don't worry about usename/password. first get your cluster up in green make sure you can connect from kibana and then concentrate on putting data in it.

it looks like it cluster is up but it is in yellow stat as you have one unassigned shards

run this  
curl -XGET localhost:9200/\_cat/shards?pretty  
see one shard it is complaining about.

---

<div class="post-metadata">

**Author:** ![Maria\_Elle](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@Maria\_Elle](https://discuss.elastic.co/u/Maria_Elle)\
**Post date:** [January 24, 2021, 1:54am UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005/9 "2021-01-24T01:54:17Z")

</div>

I ran the command and this was the output, I don't quite know what it means.

Thank you for your help, I appreciate it!

 ![Screen Shot 2021-01-23 at 8.50.01 PM](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b6b873268a031b93066fd90dc87d7cc27f57c74a.png)

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [January 25, 2021, 2:38pm UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005/10 "2021-01-25T14:38:50Z")

</div>

you can delete this index. restart your elastic stack and it will create new index. which version of ELK is this? this looks older version ( from logo)

curl -XDELETE localhost:9200/.kibana

Restart cluster  
check it status.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2021, 2:38pm UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005/11 "2021-02-22T14:38:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
