6.6 upgrade to 6.7 on Elastic Cloud Uptime data not showing

[frankfoti (Frank J. Foti ECE)]

We upgraded from 6.6 to 6.7 on Elastic Cloud Elasticsearch and Kibana. Then upgraded heartbeat on our internal vm's shipping to logstash. We also re-created the heartbeat template from the heartbeat 6.7 home.

The Uptime page shows in kibana but no data is viewable.

Thanks

[frankfoti (Frank J. Foti ECE)]

Elasticsearch is receiving docs from heartbeat...
"{
"_index": "heartbeat-6.6.0-2019.04.02",
"_type": "doc",
"_id": "EfuA3mkB0iONRnXhVGDt",
"_version": 1,
"_score": null,
"_source": {
"@timestamp": "2019-04-02T14:42:25.000Z",
"tags": [
"beats_input_raw_event"
],
"resolve": {
"host": "rrc101-196516-webui",
"rtt": {
"us": 781
},
"ip": "10.142.0.5"
},
"@version": "1",
"event": {
"dataset": "uptime"
},
"host": {
"name": "rrc101-196516-webui"
},
"requests": 1,
"monitor": {
"status": "up",
"ip": "10.142.0.5",
"id": "icmp-icmp-host-ip@rrc101-196516-webui",
"host": "rrc101-196516-webui",
"duration": {
"us": 914
},
"name": "icmp",
"type": "icmp"
},
"beat": {
"hostname": "rrc101-196516-webui",
"name": "rrc101-196516-webui",
"version": "6.7.0"
},
"rtt": {
"us": 66
}
},
"fields": {
"@timestamp": [
"2019-04-02T14:42:25.000Z"
]
},
"sort": [
1554216145000
]
}"

[frankfoti (Frank J. Foti ECE)]

I changed logstash to send a 6.7 index name and created a new pattern: heartbeat-6.7.0-**

Here is the new json in discover:
"
{
"_index": "heartbeat-6.7.0-2019.04.02",
"_type": "doc",
"_id": "uSwC4GkB0iONRnXhJm95",
"_version": 1,
"_score": null,
"_source": {
"@version": "1",
"tls": {
"certificate_not_valid_after": "2019-04-27T23:59:59.000Z",
"certificate_not_valid_before": "2016-01-28T00:00:00.000Z",
"rtt": {
"handshake": {
"us": 2963
}
}
},
"tcp": {
"rtt": {
"connect": {
"us": 523
}
},
"port": 443
},
"beat": {
"hostname": "rrc102-198819-rrc102-wpar",
"name": "rrc102-198819-rrc102-wpar",
"version": "6.7.0"
},
"@timestamp": "2019-04-02T21:43:50.000Z",
"tags": [
"beats_input_raw_event"
],
"resolve": {
"host": "cloud1.rationalenterprise.com",
"rtt": {
"us": 886
},
"ip": "35.229.64.130"
},
"event": {
"dataset": "uptime"
},
"host": {
"name": "rrc102-198819-rrc102-wpar"
},
"monitor": {
"status": "up",
"ip": "35.229.64.130",
"id": "http@https://cloud1.rationalenterprise.com/#/core/login",
"host": "cloud1.rationalenterprise.com",
"duration": {
"us": 310665
},
"scheme": "https",
"name": "http",
"type": "http"
},
"http": {
"response": {
"status_code": 200
},
"url": "https://cloud1.rationalenterprise.com/#/core/login",
"rtt": {
"total": {
"us": 309651
},
"response_header": {
"us": 306043
},
"write_request": {
"us": 67
},
"validate": {
"us": 306091
},
"content": {
"us": 48
}
}
}
},
"fields": {
"tls.certificate_not_valid_after": [
"2019-04-27T23:59:59.000Z"
],
"tls.certificate_not_valid_before": [
"2016-01-28T00:00:00.000Z"
],
"@timestamp": [
"2019-04-02T21:43:50.000Z"
]
},
"highlight": {
"beat.hostname": [
"@kibana-highlighted-field@rrc102@/kibana-highlighted-field@-@kibana-highlighted-field@198819@/kibana-highlighted-field@-@kibana-highlighted-field@rrc102@/kibana-highlighted-field@-@kibana-highlighted-field@wpar@/kibana-highlighted-field@"
]
},
"sort": [
1554241430000
]
}"

[dov0211]

Update: Customer had Dropped all existing heartbeat templates and indices then created a single new 6.7.0 template. When the new index came in from logstash all was resolved.

[warkolm (Mark Walkom)]

Just a quick suggestion @frankfoti, it is helpful to wrap code/logs/data in markdown style backticks, or use the </> (code formatting) button to make things easier to read

[jkambic (Justin Kambic)]

@dov0211 thanks for the summary explaining the solution!

[frankfoti (Frank J. Foti ECE)]

{

"_index": "heartbeat-6.7.0-2019.04.02",
"_type": "doc",
"_id": "uSwC4GkB0iONRnXhJm95",
"_version": 1,
"_score": null,
"_source": {
"@version": "1",
"tls": {
"certificate_not_valid_after": "2019-04-27T23:59:59.000Z",
"certificate_not_valid_before": "2016-01-28T00:00:00.000Z",
"rtt": {
"handshake": {
"us": 2963
}
}
}