Fails to open the Filebeat auditd dashboard in Kibana

[monicasarbu]

After loading the dashboard for the auditd module in Filebeat, the following error is printed by Kibana:

[monicasarbu]

@andrewkroh can you please have a look? Maybe the error disappears after you have some data.

[andrewkroh]

That error makes me think that there is a error parsing the JSON query string. I should be able to run the Filebeat modules test suite to get some data populated in ES and see what happens.

[andrewkroh]

I narrow the error down to being caused by the Timelion graph no longer accepting

.es(q="_exists_:auditd.log NOT auditd.log.res:failure").label("Success") .es(q="auditd.log.res:failed").label("Failure").title("Audit Event Result")

The full error is:

Timelion: Error: in cell #1: [parsing_exception] [query_string] unknown token [START_OBJECT] after [query], with { line=1 & col=297 }
Error:  in cell #1: [parsing_exception] [query_string] unknown token [START_OBJECT] after [query], with { line=1 & col=297 }
    at throwWithCell (/usr/share/kibana/src/core_plugins/timelion/server/handlers/chain_runner.js:48:11)
    at /usr/share/kibana/src/core_plugins/timelion/server/handlers/chain_runner.js:214:11
    at bound (domain.js:280:14)
    at runBound (domain.js:293:12)
    at tryCatcher (/usr/share/kibana/node_modules/bluebird/js/main/util.js:26:23)
    at Promise._settlePromiseFromHandler (/usr/share/kibana/node_modules/bluebird/js/main/promise.js:503:31)
    at Promise._settlePromiseAt (/usr/share/kibana/node_modules/bluebird/js/main/promise.js:577:18)
    at Promise._settlePromises (/usr/share/kibana/node_modules/bluebird/js/main/promise.js:693:14)
    at Async._drainQueue (/usr/share/kibana/node_modules/bluebird/js/main/async.js:123:16)
    at Async._drainQueues (/usr/share/kibana/node_modules/bluebird/js/main/async.js:133:10)
    at Immediate.Async.drainQueues (/usr/share/kibana/node_modules/bluebird/js/main/async.js:15:14)
    at runCallback (timers.js:666:20)
    at tryOnImmediate (timers.js:639:5)
    at processImmediate [as _immediateCallback] (timers.js:611:5)

I pasted the same expression into a 5.2.2 instance I had running and there was no error.

[andrewkroh]

Adding a comma between the expressions seems to fix the issue.