visualization not working

[CVMCTONY]

O365 Beat version 1.5.0

When I open any of the visualizations I get a message such as below.

Saved object is missing

Could not locate that index-pattern (id: ceb2f990-f469-11e9-9f4d-5dd1f9c9e483),

Also the O365 Dashboard opens but all the panes say

Could not locate that index-pattern (id: ceb2f990-f469-11e9-9f4d-5dd1f9c9e483), click here to re-create it

Any Ideas? I am new to Elasticsearch.

Thanks

[chris-counteractive]

Thanks for the issue, I hope we can get things squared away for you. A couple quick questions:

1. Did you run o365beat setup against your elastic instance, before shipping logs, and is kibana running on that same system?
2. Did you make any significant modifications to your o365beat.yml file? If possible, could you add it to this issue (after removing sensitive information like IDs and client secret)?
3. By default, the visualizations should use the default index pattern o365beat-* ... do you have that pattern in kibana?

Thanks again. If you'd rather work through this via email, you can reach me at chris@counteractive.net.

[CVMCTONY]

1. Yes followed the instructions but this is a 5 node cluster and I installed the o365beat on my filebeat node not my kibana or elastic search nodes.

Do I need to install this on all my nodes delete the data and run o365beat setup before I start ingesi?

On Fri, Feb 21, 2020, 2:24 PM Chris Hendricks notifications@github.com wrote:

Thanks for the issue, I hope we can get things squared away for you. A couple quick questions:

1. Did you run o365beat setup against your elastic instance, before shipping logs, and is kibana running on that same system?
2. Did you make any significant modifications to your o365beat.yml file? If possible, could you add it to this issue (after removing sensitive information like IDs and client secret)?
3. By default, the visualizations should use the default index pattern o365beat-* ... do you have that pattern in kibana?

Thanks again. If you'd rather work through this via email, you can reach me at chris@counteractive.net.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/counteractive/o365beat/issues/38?email_source=notifications&email_token=AOS77I3C456UGEZCNP37ZTTREAS5ZA5CNFSM4KXM5TKKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEMTZWTI#issuecomment-589798221, or unsubscribe https://github.com/notifications/unsubscribe-auth/AOS77I4CH5MJN4GC7E2T4BDREAS5ZANCNFSM4KXM5TKA .

[chris-counteractive]

You definitely don't need to install the beat on all the nodes, or even on any of them (it could be running on a separate box, we see it often run on logstash boxes for example).

By default, the o365beat setup command assumes kibana is on localhost:5601, the same as other beats. If you have a more complex setup, you'll need to change your config file accordingly (o365beat.yml). Specifically, you'll need to update setup.kibana.host (which defaults to localhost:5601) and all its supporting settings. You can see these options, commented out, on these lines of the o365beat.reference.yml reference file, and the filebeat docs do a good job of walking through this too ... it generally works the same as o365beat.

If your kibana setup is correct in the config, it's possible your elasticsearch config wasn't. If you send me your (redacted) config file by email, we can sort through any remaining issues. Thanks for your patience!

[CVMCTONY]

Chris,

Thanks for the reply. I did have the kibana servers ip address defined in the yml. I have attached it for your review. Also note that the beats server is ip address of .38 and kibana is .37 and my 3 elasticserver are .246 .247 and .248

Thanks for helping get to the bottom of this

Tony

On Tue, Mar 3, 2020 at 10:56 PM Chris Hendricks notifications@github.com wrote:

You definitely don't need to install the beat on all the nodes, or even on any of them (it could be running on a separate box, we see it often run on logstash boxes for example).

By default, the o365beat setup command assumes kibana is on localhost:5601, the same as other beats. If you have a more complex setup, you'll need to change your config file accordingly (o365beat.yml). Specifically, you'll need to update setup.kibana.host (which defaults to localhost:5601) and all its supporting settings. You can see these options, commented out, on these lines https://github.com/counteractive/o365beat/blob/master/o365beat.reference.yml#L1107-L1157 of the o365beat.reference.yml reference file, and the filebeat docs https://www.elastic.co/guide/en/beats/filebeat/current/load-kibana-dashboards.html do a good job of walking through this too ... it generally works the same as o365beat.

If your kibana setup is correct in the config, it's possible your elasticsearch config wasn't. If you send me your (redacted) config file by email, we can sort through any remaining issues. Thanks for your patience!

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/counteractive/o365beat/issues/38?email_source=notifications&email_token=AOS77I2JQKU4ZG3QDY6LQPTRFXGO3A5CNFSM4KXM5TKKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOENWH6EY#issuecomment-594312979, or unsubscribe https://github.com/notifications/unsubscribe-auth/AOS77I5LCDXWDPQLMIJJUPTRFXGO3ANCNFSM4KXM5TKA .

[chris-counteractive]

As noted in #43: while researching another issue, I realized (a few months late) that filebeat now supports o365 with an official module, as of v7.7.0. It supports a variety of visualizations out of the box, and will surely stay more current with the latest updates to the Elastic Stack, including Kibana. It's probably the best solution for you going forward, if you haven't already migrated that way.

Given there's an "official solution" to visualization, and their documentation regarding Kibana setups is more thorough, I'm going to close this issue. Apologies that it went unaddressed for so long. Thanks for engaging with the project!