# \[Winlogbeat 7.10.1 dashboards\]: could not locate some index pattern fields **URL:** \ **Category:** Kibana\ **Tags:** windows\ **Created:** [January 19, 2021, 11:24am UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261530 "2021-01-19T11:24:29Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [January 19, 2021, 11:24am UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261530/1 "2021-01-19T11:24:30Z")
Hello, I am using Elasticsearch, kibana, logstash, and winlogbeat, all version 7.10.1 I configured winlogbeat and run: `.\winlogbeat.exe setup -e` and I had no error in my winlogbeat logs, but in kibana there are some dashboards working and some of them I am getting errors: ``` Could not locate that index-pattern-field (id: powershell.connected_user.name) Could not locate that index-pattern-field (id: powershell.command.name) ``` The issue here is that the fields are not found in the index pattern. ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/8/88c5961da080c8bc6ac735efc3b070f68072fc9e.png) - Also when trying to test some PowerShell commands on the beats clients I can see that they are not listed / counted in Kibana! ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/d/cdbce606a03b1c2091be4d6e361266470393dd2f.png) Any help is really appreciated. Regards, ---
**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\ **Post date:** [January 20, 2021, 7:08pm UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261530/2 "2021-01-20T19:08:57Z")
I think you need to click the refresh button on your Kibana index pattern- if I remember correctly, this is not automatically done with the setup command. Index patterns will automatically refresh starting in 7.11, but not yet. ---
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [January 21, 2021, 7:25am UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261530/3 "2021-01-21T07:25:17Z")
Thanks @wylie unfortunately refreshing the index pattern didn't help in this, can you please tell if I can add them (the fields) manually and how? ---
**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\ **Post date:** [January 21, 2021, 4:22pm UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261530/4 "2021-01-21T16:22:58Z")
If you refreshed your index pattern and it's still missing fields, then that means you have a more basic problem. Are you sure that winlogbeat is set up correctly? Have you validated that you are seeing data from winlogbeat in Elastisearch? ---
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [January 22, 2021, 7:39am UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261530/5 "2021-01-22T07:39:44Z")
yes @wylie I've set up winlogbeat as listed in the documentation, also I've run the command ``` .\winlogbeat.exe setup -e ``` again in order to reship the assets (dashboards and index) as advised but with no luck. Also yes I can see the logs in elasticsearch and most of the visualizations are ok, only the ones I've mentioned. ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/b/5b54df2c7038e6dfa4d36b53710fe6379ca153cc.png) I can see that other people having same issue here: > [@\[Winlogbeat 7.10.1 dashboards\]: could not locate some index pattern fields](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/259961): > > Hello, I am using Elasticsearch, kibana and winlogbeat, all version 7.10.1 I configured winlogbeat and run: .\winlogbeat.exe setup -e and I had no error in my winlogbeat logs, but in kibana there are some dashboards working and some of them I am getting errors: Could not locate that index-pattern-field (id: powershell.connected\_user.name) Could not locate that index-pattern-field (id: powershell.engine.version) Could not locate that index-pattern-field (id: powershell.command.name) Could not … Any help in this? Regards, ---
**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\ **Post date:** [January 22, 2021, 3:41pm UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261530/6 "2021-01-22T15:41:17Z")
Okay, I see. Maybe the built-in dashboards are buggy, or maybe there is a bug in the winlogbeat collection of data. I think asking in the Beats forum like the one you posted will be the right place to look for help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 19, 2021, 3:41pm UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261530/7 "2021-02-19T15:41:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.