Winlogbeat v5 Dashboard Error (Fielddata is disabled on text fields)

Elastic Stack Beats
1

Hi. Just setup my windows 2012 server to send eventlogs to ES (via winlogbeat and LS).
I also uploaded the dashboard as per document here -

https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-sample-dashboards.html

Now from within Kibana when I go to the winlogbeat dashboard I see this message on the top and the main window doesn't show as much info as I am use to in the past with previous versions.

"Visualize: Fielddata is disabled on text fields by default. Set fielddata=true on [log_name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory."

Not sure if this is related but I believe I need to load the template manually if I am using LS (which I am)

https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html#load-template-manually

But it looks like it's missing some info?

Any assistance that anybody can give will be appreciated. TIA.

2

Yes, that error would occur if the template is not loaded. So follow the instructions from that link to load the template

You should probably stop Winlogbeat first, delete the registry file (C:/ProgramData/winlogbeat/registry IIRC), delete the winlobeat-* indices from ES, install the template, restart Winlogbeat.

3

Yes thanks.
I ran this command from within powershell and then deleted index winlogbeat* and also stopped winlogbeat service and then .winlogbeat.yml file and then started service and now its working thanks.

Just 1 more Q, I heard that winlogbeat dashboard in v5.x was much better than those supplied in 2.x but they look the same to me?

4

The example dashboard is the same, but the underlying data provided by Winlogbeat 5 is more rich which can enable you to create some great dashboards or alerts yourself. The data from v5 contains the raw parameters used by the application when it created the event log record. This data is found in event_data.*. Previously in v1, you would have had to grok the message field to extract this data before you could make use of it.

Here's an example I created for logons (dashboard is linked at the end): Monitoring Windows Logons with Winlogbeat

5

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.