Recently I’ve been tryout Elasticsearch 7 with Kibana and Metricbeat as well as Filebeat. I encountered some issues with indices so I dropped dashboards and visualizations and tried to load them again. I also cleared indices and patterns thru index management page. If you get error message like “could not locate that index-pattern” or something with fields being non-optimized then you should take few actions.

Please note that it was my lab Elastic installation so I do not care about deleting indices.

First you need to either stop all of your metricbeat modules sending data to the cluster or do some magic with the indices itself to prevent from auto-creating. Then delete all indices related to those two modules as well as its index patterns. Then go to Saved objects and delete all visualizations and dashboards. If you have custom things, then most probably you need to remember not to select them for deletion. If you have cleared out all of these you may go to sample machine with metricbeat node and run:

sudo metricbeat setup --index-management
sudo metricbeat setup --dashboards

Effectively you will get a index alias and bare index pointing at each other. This is the main difference between manually creating pattern and letting metricbeat doing its things properly. Now you should have visualizations created correctly which means that also dashboads should work fine. Neither Elasticsearch 7 is working correctly nor messages are saying anything useful. Maybe version 8 brings little more in this aspect, but I thought that writing about this case might save some time for someone looking for similar issue happening on their environment.