Crosscompiled Metricbeat metrics not visible in Kibana

Elastic Stack Beats
1

Hi!

I have recently been trying to get the following setup to run:

Kibana & Elasticsearch on a x86, dockerized (compose) in recent a virtual Debian Linux system.
Metricbeat sits in am arm64-alpine container on the arm64 device, I crosscompiled and it appears to be running.

This is the log from metricbeat starting:

image
image.png1908×602 88.3 KB

Now, when I go to "discover" I can see the metricbeat index - but there appears to be no fields in it. Furthermore see the "docs" counter ticking upward - yet I don't see any selectable data.

Trying with an amd64 container on the host running kibana&ES shows me the metrics immediately in Kibana. (same config)

The configuration is as follows:

image
image.png913×737 18.4 KB

image
image
image.png274×509 2.82 KB

Sorry for the somewhat funky format of the config - it's the result from ' grep -v "^#" ' and shabby screenshotting skills.

It kinda bugs me that the log suggests everything is fine (I see the metrics there and it tells me it succesfully connected) - but something is not in order; maybe you have a clue/hint that helps me find the culprit?

I did try to follow guides and the documentation, but since my use-case is somewhat non-mainstreamish (the cross-compilation) it has proven to be trickier than I thought.

Much appreciated
Oliver

2

PS: I assumed Metricbeat 7.4.3 to be compatible with 7.4.2 - cause I think I read that the smaller release numbers should not break backward compatiblity.

I tried with metricbeat 8.0.0 initially - (from git master branch) - and it did not seem to behave any different.

3

I did find the culprit that caused the issue.

It was a mismatched timestamp format ~_~
Checking elasticsearch for content revealed that metricbeat is properly pushing the data

Once i had selected "I don't want to use time filter" instead of "@timestamp" during index-pattern creation, all the data was present in the discover tab.

Thus I had to tweak the timestamp format for it be understood.

Sorry for opening a topic - don't think it should've been necessary if I had done my troubleshooting homework.

Regards
Oliver

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.