# What is my "index patter"? **URL:** \ **Category:** Kibana\ **Created:** [June 19, 2017, 8:32am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900 "2017-06-19T08:32:32Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 4, 2017, 7:35am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/21 "2017-07-04T07:35:01Z")
It seems Logstash is not able to connect to Elasticsearch. Is Elasticsearch running? Can you reach port 9200 on the Elasticsearch host from the host where Logstash is running, e.g using telnet? ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 4, 2017, 7:37am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/22 "2017-07-04T07:37:46Z")
Elasticsearch is running: ```auto # service elasticsearch status ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2017-07-04 03:50:33 EDT; 41min ago Docs: http://www.elastic.co Main PID: 1344 (java) CGroup: /system.slice/elasticsearch.service └─1344 /bin/java -Xms2g -Xmx2g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -XX:+Always... Jul 04 03:50:33 localhost.localdomain systemd[1]: Starting Elasticsearch... Jul 04 03:50:33 localhost.localdomain systemd[1]: Started Elasticsearch. ``` and ```auto # netstat -naultp Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 3990/nginx: master tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1337/sshd tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2481/master tcp 0 0 127.0.0.1:5601 0.0.0.0:* LISTEN 923/node tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 922/syslog-ng tcp 0 0 172.30.9.20:80 172.30.10.18:45044 TIME_WAIT - tcp 0 0 127.0.0.1:38176 127.0.0.1:9200 ESTABLISHED 923/node tcp 0 188 172.30.9.20:22 172.30.10.18:57694 ESTABLISHED 2787/sshd: root@pts tcp 0 0 127.0.0.1:38178 127.0.0.1:9200 ESTABLISHED 923/node tcp6 0 0 ::1:9200 :::* LISTEN 1344/java tcp6 0 0 127.0.0.1:9200 :::* LISTEN 1344/java tcp6 0 0 ::1:9300 :::* LISTEN 1344/java tcp6 0 0 127.0.0.1:9300 :::* LISTEN 1344/java tcp6 0 0 :::22 :::* LISTEN 1337/sshd tcp6 0 0 ::1:25 :::* LISTEN 2481/master tcp6 0 0 127.0.0.1:9200 127.0.0.1:38178 ESTABLISHED 1344/java tcp6 0 0 127.0.0.1:9200 127.0.0.1:38176 ESTABLISHED 1344/java udp 0 0 0.0.0.0:514 0.0.0.0:* 922/syslog-ng ``` ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 4, 2017, 7:42am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/23 "2017-07-04T07:42:32Z")
It is odd !!! Why my "Time-field name" disabled? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 4, 2017, 7:45am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/24 "2017-07-04T07:45:02Z")
Have you tried connecting to it from The Logstash instance? It looks like Elasticsearch is bound to 127.0.0.1:9200, which is not accessible from outside that machine. You will need to change your Elasticsearch config to bind to `0.0.0.0` (all interfaces) or the external IP address (172.30.9.20) of the Elasticsearch host. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 4, 2017, 7:48am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/25 "2017-07-04T07:48:31Z")
How can I bind it to "0.0.0.0" ? My Elasticsearch config is: ```auto # ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most settings. # Before you set out to tweak and tune the configuration, make sure you # understand what are you trying to accomplish and the consequences. # # The primary way of configuring a node is via this file. This template lists # the most important settings you may want to configure for a production cluster. # # Please consult the documentation for further information on configuration options: # https://www.elastic.co/guide/en/elasticsearch/reference/index.html # # ---------------------------------- Cluster ----------------------------------- # # Use a descriptive name for your cluster: # #cluster.name: my-application # # ------------------------------------ Node ------------------------------------ # # Use a descriptive name for the node: # #node.name: node-1 # # Add custom attributes to the node: # #node.attr.rack: r1 # # # Path to directory where to store the data (separate multiple locations by comma): # #path.data: /path/to/data # # Path to log files: # #path.logs: /path/to/logs # # ----------------------------------- Memory ----------------------------------- # # Lock the memory on startup: # #bootstrap.memory_lock: true # # Make sure that the heap size is set to about half the memory available # on the system and that the owner of the process is allowed to use this # limit. # # Elasticsearch performs poorly when the system is swapping the memory. # # ---------------------------------- Network ----------------------------------- # # Set the bind address to a specific IP (IPv4 or IPv6): # network.host: localhost # # Set a custom port for HTTP: # #http.port: 9200 # # For more information, consult the network module documentation. # # --------------------------------- Discovery ---------------------------------- # # Pass an initial list of hosts to perform discovery when new node is started: # The default list of hosts is ["127.0.0.1", "[::1]"] # #discovery.zen.ping.unicast.hosts: ["host1", "host2"] # # Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1): # #discovery.zen.minimum_master_nodes: 3 # # For more information, consult the zen discovery module documentation. # # ---------------------------------- Gateway ----------------------------------- # # Block initial recovery after a full cluster restart until N nodes are started: # #gateway.recover_after_nodes: 3 # # For more information, consult the gateway module documentation. # # ---------------------------------- Various ----------------------------------- # # Require explicit names when deleting indices: # #action.destructive_requires_name: true #script.disable_dynamic: true ``` ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 4, 2017, 7:54am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/26 "2017-07-04T07:54:38Z")
I guess "network.host: 0.0.0.0" ? Any idea? ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 17, 2017, 12:04pm UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/29 "2017-07-17T12:04:08Z")
I set "network.host: 0.0.0.0" but my "Elasticsearch" can't running: ```auto service elasticsearch status ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Mon 2017-07-17 08:58:10 EDT; 33s ago Docs: http://www.elastic.co Process: 3557 ExecStart=/usr/share/elasticsearch/bin/elasticsearch -p ${PID_DIR}/elasticsearch.pid --quiet -Edefault.path.logs=${LOG_DIR} -Edefault.path.data=${DATA_DIR} -Edefault.path.conf=${CONF_DIR} (code=exited, status=1/FAILURE) Process: 3554 ExecStartPre=/usr/share/elasticsearch/bin/elasticsearch-systemd-pre-exec (code=exited, status=0/SUCCESS) Main PID: 3557 (code=exited, status=1/FAILURE) Jul 17 08:58:10 localhost.localdomain elasticsearch[3557]: at org.elasticsearch.node.InternalSettingsPreparer.prepareEnvironment(InternalSe...a:100) Jul 17 08:58:10 localhost.localdomain elasticsearch[3557]: at org.elasticsearch.cli.EnvironmentAwareCommand.createEnv(EnvironmentAwareComma...va:72) Jul 17 08:58:10 localhost.localdomain elasticsearch[3557]: at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:67) Jul 17 08:58:10 localhost.localdomain elasticsearch[3557]: at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122) Jul 17 08:58:10 localhost.localdomain elasticsearch[3557]: at org.elasticsearch.cli.Command.main(Command.java:88) Jul 17 08:58:10 localhost.localdomain elasticsearch[3557]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:91) Jul 17 08:58:10 localhost.localdomain elasticsearch[3557]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:84) Jul 17 08:58:10 localhost.localdomain systemd[1]: elasticsearch.service: main process exited, code=exited, status=1/FAILURE Jul 17 08:58:10 localhost.localdomain systemd[1]: Unit elasticsearch.service entered failed state. Jul 17 08:58:10 localhost.localdomain systemd[1]: elasticsearch.service failed. Hint: Some lines were ellipsized, use -l to show in full. ``` Any idea? ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 17, 2017, 12:11pm UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/30 "2017-07-17T12:11:19Z")
I use "Nginx" and configured it for Kibana as below: ```auto # nano /etc/nginx/conf.d/kibana.conf server { listen 80; server_name example.com; auth_basic "Restricted Access"; auth_basic_user_file /etc/nginx/htpasswd.users; location / { proxy_pass http://localhost:5601; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_cache_bypass $http_upgrade; } } ``` Can it cause any problem? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 17, 2017, 1:02pm UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/31 "2017-07-17T13:02:04Z")
Is there anything in the logs when you start up Elasticsearch? ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 21, 2017, 9:34am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/32 "2017-07-21T09:34:54Z")
Which logs? I change "network.host: localhost" and "Logstash" can launch. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 21, 2017, 9:49am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/33 "2017-07-21T09:49:39Z")
Look in the elasticsearch logs. The location should be available in your elasticsearch.yml file. It is very likely that the logs will contain warnings about failed [bootstrap checks](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/bootstrap-checks.html) that you will need to fix in order to be able to connect to an IP other than localhost. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 21, 2017, 10:46am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/35 "2017-07-21T10:46:28Z")
Log said me: [https://pastebin.com/GtSc9RE2](https://pastebin.com/GtSc9RE2) is it the log that you need? The log location in my config file is commented and I guess that I must uncomment it !!! ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 21, 2017, 11:21am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/36 "2017-07-21T11:21:48Z")
If it is commented out it will use the default location, which will depend on how you installed Elasticsearch. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 21, 2017, 11:39am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/37 "2017-07-21T11:39:04Z")
OK. I set it to "path.logs: /var/log/elastic". What is the next step? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 21, 2017, 11:41am UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/38 "2017-07-21T11:41:35Z")
Set network host to `0.0.0.0`, start Elasticsearch and check what errors and warnings appear in the logs. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 21, 2017, 12:02pm UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/39 "2017-07-21T12:02:29Z")
Ah, It is OK and no error. So? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 21, 2017, 12:09pm UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/40 "2017-07-21T12:09:14Z")
If there are no errors in the log and it starts up fine I assume it is working? ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 21, 2017, 12:24pm UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/41 "2017-07-21T12:24:16Z")
I'm on step one. I got "No default index pattern. You must select or create one to continue." error and "Time-field name" is empty. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 21, 2017, 12:37pm UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/42 "2017-07-21T12:37:40Z")
Do you have any data in Elasticsearch? Go into `Dev Tools` and run `GET _cat/indices` to list the indices available in the cluster. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [July 21, 2017, 1:22pm UTC](https://discuss.elastic.co/t/what-is-my-index-patter/89900/43 "2017-07-21T13:22:37Z")
Data? I collected Windows event logs and stored it via Logstash as you see. Result is : ```auto yellow open .kibana oRgrhDK4TRW4-C-AafI_ag 1 1 1 0 3.1kb 3.1kb ``` [Previous page](https://discuss.elastic.co/t/what-is-my-index-patter/89900.md?page=1) [Next page](https://discuss.elastic.co/t/what-is-my-index-patter/89900.md?page=3)