# \[Winlogbeat 7.10.1 dashboards\]: could not locate some index pattern fields

**URL:** <https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [December 31, 2020, 1:24pm UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961 "2020-12-31T13:24:06Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abdelhalim](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\
**Post date:** [December 31, 2020, 1:24pm UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961/1 "2020-12-31T13:24:06Z")

</div>

Hello,

I am using Elasticsearch, kibana and winlogbeat, all version 7.10.1

I configured winlogbeat and run: `.\winlogbeat.exe setup -e` and I had no error in my winlogbeat logs, but in kibana there are some dashboards working and some of them I am getting errors:

```auto
Could not locate that index-pattern-field (id: powershell.connected_user.name)
Could not locate that index-pattern-field (id: powershell.engine.version)
Could not locate that index-pattern-field (id: powershell.command.name)
Could not locate that index-pattern-field (id: powershell.provider.name)

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6b9ab473391cc2b5fdb6b2dc8faade2f892da37e.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/6/363eebc1a9833717246564a94ae02f1ed70df7b8.png)

Could you tell please how to solve these errors

Thanks

---

<div class="post-metadata">

**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\
**Post date:** [January 19, 2021, 10:40am UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961/2 "2021-01-19T10:40:39Z")

</div>

Having same issue here, did you managed to solve this out? Please let me no.

Regards,

---

<div class="post-metadata">

**Author:** ![Abdelhalim](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\
**Post date:** [January 19, 2021, 10:53am UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961/3 "2021-01-19T10:53:38Z")

</div>

Hi @ethical20,

Till now I didn't find out how to solve this errors, I will keep you updated if I find something  
It could be cause I am not running powershell command in my machines, but in this case it should display 0 and not error, so a little bit confusing

Best regards

---

<div class="post-metadata">

**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\
**Post date:** [January 19, 2021, 11:02am UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961/4 "2021-01-19T11:02:45Z")

</div>

Thanks @Abdelhalim

Have you tried to rerun this `.\winlogbeat.exe setup -e `as listed here :

> [Dashboard could not locate the index-pattern | Filebeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/could-not-locate-index-pattern.html)

I couldn't manage to rerun this as it needs direct connection to elasticsearch and not logstash which is something I'm having trouble with. So if this run from your side with no errors please let me know.

Also I found this where we can add them manually, but honestly am not expert in this and I'm afraid to break things up.

> [Update mapping API | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html)

Good Luck.

Regards,

---

<div class="post-metadata">

**Author:** ![Abdelhalim](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\
**Post date:** [January 19, 2021, 11:10am UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961/5 "2021-01-19T11:10:01Z")

</div>

I already tried `.\winlogbeat.exe setup -e` as I mentionned it in my first post, it worked correctly and I hadn't any error in my logs, the only problem is in the dashboards.

I couldn't understand why you couldn't run again the command ! if you have some errors in your logs, you can show them, and maybe I can help you

---

<div class="post-metadata">

**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\
**Post date:** [January 19, 2021, 3:28pm UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961/6 "2021-01-19T15:28:17Z")

</div>

update: I was able to run the command again , ingested the template and Kibana dashboards but unfortunately this didn't solve the main issue.

Still the number of fields in the index pattern the same with missing ones!

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/8/88c5961da080c8bc6ac735efc3b070f68072fc9e.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 16, 2021, 5:28pm UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961/7 "2021-02-16T17:28:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
