diff --git a/.gitignore b/.gitignore
index df10e8f0dee..0d8f4afd484 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,3 +37,4 @@ _testmain.go
 last_run
 
 *.test
+.DS_Store
diff --git a/docs/gettingstarted.asciidoc b/docs/gettingstarted.asciidoc
index d37039eedc7..26c637ce59e 100644
--- a/docs/gettingstarted.asciidoc
+++ b/docs/gettingstarted.asciidoc
@@ -309,13 +309,13 @@ it from the `config/kibana.yml` file.
 Now point your browser to port 5601 and you should see the Kibana web
 interface.
 
-The first thing you need to do is to configure the index pattern. In
+The first thing you need to do is to configure the index pattern. Select *Use event times to create index names*, in
 the *Index name or pattern* field enter `[packetbeat-]YYYY.MM.DD` and for the *Time-field
 name* select `timestamp`.
 
 image:./images/kibana-index-pattern.png[Kibana index pattern]
 
-If after you configure the `[packetbeat-]YYYY.MM.DD` index pattern Kibana still says
+If after you selected *Use event times to create index names* and configured the `[packetbeat-]YYYY.MM.DD` index pattern Kibana still says
 _Unable to fetch mapping. Do you have indices matching the pattern?_, it means
 that Packetbeat hasn't yet written any data into Elasticsearch. Make sure that
 some traffic was running on your servers and that Packetbeat could see it.
diff --git a/docs/images/kibana-index-pattern.png b/docs/images/kibana-index-pattern.png
index 3866d2441ef..4346d253558 100644
Binary files a/docs/images/kibana-index-pattern.png and b/docs/images/kibana-index-pattern.png differ