From 17b116ba24bf8f6f702d08a09646a9d196463ecd Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Mon, 27 Apr 2020 13:24:32 -0700 Subject: [PATCH 1/3] [docs] Document workaround for could not find index pattern problem --- libbeat/docs/shared-faq.asciidoc | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/libbeat/docs/shared-faq.asciidoc b/libbeat/docs/shared-faq.asciidoc index dc0fbeb77ad..a5b093a4ce1 100644 --- a/libbeat/docs/shared-faq.asciidoc +++ b/libbeat/docs/shared-faq.asciidoc @@ -144,3 +144,25 @@ endif::no-output-logstash[] === Monitoring UI shows fewer Beats than expected If you are running multiple Beat instances on the same host, make sure they each have a distinct `path.data` value. + +ifndef::no_dashboards[] +[[could-not-locate-index-pattern]] +=== {beatname_uc} dashboard could not locate the index-pattern + +Typically {beatname_uc} sets up the index pattern automatically when it +loads the index template. However, if for some reason {beatname_uc} loads the +index template, but the index pattern does not get created correctly, you'll see +a "could not locate that index-pattern" error. To resolve this problem, you can +create the index pattern manually in {kib}. + +When you create the index pattern: + +* Set the *Time filter field name* to `@timestamp`. +* If you're using a custom index name, set the *Custom index pattern ID* +advanced option. For example, if your custom index name is ++{beatname_lc}-customname+, set the custom index pattern ID to ++{beatname_lc}-customname-*+. + +For more information, see {kibana-ref}/index-patterns.html[Creating an index +pattern] in the {kib} docs. +endif::no_dashboards[] From 2a538fe4b28e4de1cb986308602540eb07609b31 Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Thu, 30 Apr 2020 19:55:39 -0700 Subject: [PATCH 2/3] Add fixes from review --- libbeat/docs/shared-faq.asciidoc | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/libbeat/docs/shared-faq.asciidoc b/libbeat/docs/shared-faq.asciidoc index a5b093a4ce1..eaabb37b21b 100644 --- a/libbeat/docs/shared-faq.asciidoc +++ b/libbeat/docs/shared-faq.asciidoc @@ -147,21 +147,28 @@ If you are running multiple Beat instances on the same host, make sure they each ifndef::no_dashboards[] [[could-not-locate-index-pattern]] -=== {beatname_uc} dashboard could not locate the index-pattern +=== Dashboard could not locate the index-pattern Typically {beatname_uc} sets up the index pattern automatically when it loads the index template. However, if for some reason {beatname_uc} loads the index template, but the index pattern does not get created correctly, you'll see -a "could not locate that index-pattern" error. To resolve this problem, you can -create the index pattern manually in {kib}. +a "could not locate that index-pattern" error. To resolve this problem: -When you create the index pattern: +. Try running the `setup` command again. For example: +./{beatname_lc} setup+. +. If that doesn't work, go to the Management app in {kib}, and under +*Index Patterns*, look for the pattern. +.. If the pattern exists, click it, then click Refresh. + +.. If the pattern doesn't exist, create it manually. ++ +-- * Set the *Time filter field name* to `@timestamp`. * If you're using a custom index name, set the *Custom index pattern ID* advanced option. For example, if your custom index name is +{beatname_lc}-customname+, set the custom index pattern ID to +{beatname_lc}-customname-*+. +-- For more information, see {kibana-ref}/index-patterns.html[Creating an index pattern] in the {kib} docs. From 76c693cb567014fc0899adde9c53a50fbd00d25a Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Tue, 5 May 2020 16:40:41 -0700 Subject: [PATCH 3/3] Clarify guidance around setting custom index pattern --- libbeat/docs/shared-faq.asciidoc | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/libbeat/docs/shared-faq.asciidoc b/libbeat/docs/shared-faq.asciidoc index eaabb37b21b..76d55844f56 100644 --- a/libbeat/docs/shared-faq.asciidoc +++ b/libbeat/docs/shared-faq.asciidoc @@ -164,10 +164,9 @@ a "could not locate that index-pattern" error. To resolve this problem: + -- * Set the *Time filter field name* to `@timestamp`. -* If you're using a custom index name, set the *Custom index pattern ID* -advanced option. For example, if your custom index name is -+{beatname_lc}-customname+, set the custom index pattern ID to -+{beatname_lc}-customname-*+. +* Set the *Custom index pattern ID* advanced option. For example, if your +custom index name is +{beatname_lc}-customname+, set the custom index pattern ID +to +{beatname_lc}-customname-*+. -- For more information, see {kibana-ref}/index-patterns.html[Creating an index