Dashboard data showing 0 in intervals

[maasid (Mattias)]

Hello,

I have setup multiple dashboards, ranging from Metricbeat, Filebeat, Packetbeat etc. When I'm looking at my Metricbeat dashboards I have the refresh set to 10 sec and the span set to 15m, on each refresh I may or may not see data, meaning my gauges, top n, etc could on one refresh have data and on the other it might be 0. When I look at the data flowing in to Elastic its all showing proper data meaning its not 0. Could anyone please explain why this is happening.

[Wolfram_Haussig]

Hi,

this seems to be the same error as here: https://github.com/elastic/kibana/issues/16124

Which interval do you have defined in metricbeat? Is it possible that the interval is set to more than 10 seconds?

[maasid (Mattias)]

Is this the information you are looking for? Or where can I see the interval?

[maasid (Mattias)]

I have tried with 10sec intervals as well but same result.

[maasid (Mattias)]

As you can see in the attached the intervals show data and no data....

[Wolfram_Haussig]

No, there are two settings which might be relevant:
The first is in the Beats config/Module config. Example MetricBeat: We use MetricBeat with the system module so in the file ./metricbeat-6.5.4-linux-x86_64/modules.d/system.yml are the following lines:

- module: system
  period: 10s
  metricsets:
    - cpu
    - memory
    - network
    - process
    - process_summary
    - socket_summary
  process.include_top_n:
    by_cpu: 5
    by_memory: 5

- module: system
  period: 1m
  metricsets:
    - filesystem
    - fsstat
  processors:
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'

this means that data like cpu usage will be gathered every 10 seconds while filesystem data will be gathered only every minute.

Now, the tricky part is Kibana. Check which Visualization causes you problems by opening the Dashboard and click on Edit on the upper right and after opening the options of the visualization select "edit visualization".

Here, choose "Panel options" and lok at the interval.

If the value in the visualization is lower than the period in the Beats config Kibana will refresh more often than the Beat produces data. Therefore, the dashboard in Kibana will show empty data.

As a workaround until Kibana/Beats solve this problem you can change the value either in Beats or in Kibana so the Kibana value is equal or higher than the value configured in Beats.

[maasid (Mattias)]

Thank you wolfram for your answer, indeed I have applied this and it works to a certain extent. I have left the intervals at the default 10 sec.

However, perhaps we can get an answer from an official Elastic employee, I mean people use to pay for the xpack features which are now free and this is what they got? Doesn't seem acceptable to me. What is the auto feature doing in the bucket? Nothing from what I can see.
I have used a good few of the beats provided dashboards and they should work out of the box otherwise they should not be provided in the service.