# Dashboards and visualizations seem out of date

**URL:** https://discuss.elastic.co/t/dashboards-and-visualizations-seem-out-of-date/136112
**Category:** Beats
**Tags:** filebeat
**Created:** [June 15, 2018, 2:51pm UTC](https://discuss.elastic.co/t/dashboards-and-visualizations-seem-out-of-date/136112 "2018-06-15T14:51:04Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![CW360\_Michael](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cw360_michael/32/31437_2.png) [@CW360\_Michael](https://discuss.elastic.co/u/CW360_Michael)
#### Post date: [June 15, 2018, 2:51pm UTC](https://discuss.elastic.co/t/dashboards-and-visualizations-seem-out-of-date/136112/1 "2018-06-15T14:51:04Z")

</div>

After upgrading everything to 6.3 the only issues I'm seeing are with Filebeat dashboards and visualizations.

Here's a screenshot showing the UI throwing fits:

 ![Filebeat_Nginx__Overview-_Kibana](https://us1.discourse-cdn.com/elastic/original/3X/4/2/42a9dae138b70674673553317d29e2f4beee74c6.png)

I've removed and reinstalled all dashboards, visualizations and indexes by manually clearing things in Kibana and re-running `filebeat setup`. I've also refreshed field lists.

When I edit the dashboards and visualizations and change something like "nginx.error.level" to "nginx.error.level.keyword" things work as expected. Manually updating visualizations and dashboards in most cases seems to fix things but I was hoping they'd have already been updated as part of 6.3.

Am I doing something wrong? Is there a proper way to get updated dashboards/visualizations for 6.3?

From going through the forums I know that log output for ES is asked for and not often provided. I'm providing it at [https://gist.github.com/ActionScripted/abe19281756df0a73ca818405f003e37](https://gist.github.com/ActionScripted/abe19281756df0a73ca818405f003e37) for good measure, but this seems to me to be an issue of outdated dashboards/visualizations leading to ES errors.

---

<div class="post-metadata">

### Author: ![CW360\_Michael](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cw360_michael/32/31437_2.png) [@CW360\_Michael](https://discuss.elastic.co/u/CW360_Michael)
#### Post date: [June 15, 2018, 2:54pm UTC](https://discuss.elastic.co/t/dashboards-and-visualizations-seem-out-of-date/136112/2 "2018-06-15T14:54:21Z")

</div>

Using [https://github.com/elastic/beats/blob/master/filebeat/module/nginx/\_meta/kibana/6/dashboard/Filebeat-nginx-overview.json](https://github.com/elastic/beats/blob/master/filebeat/module/nginx/_meta/kibana/6/dashboard/Filebeat-nginx-overview.json) I've been manually updating things to slowly get everything working again.

Any time I see something like `"terms_field": "nginx.access.url"` in the visualization JSON I replace it in Kibana with `nginx.access.url.keyword` and it starts working.

---

<div class="post-metadata">

### Author: ![CW360\_Michael](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cw360_michael/32/31437_2.png) [@CW360\_Michael](https://discuss.elastic.co/u/CW360_Michael)
#### Post date: [June 15, 2018, 3:11pm UTC](https://discuss.elastic.co/t/dashboards-and-visualizations-seem-out-of-date/136112/3 "2018-06-15T15:11:31Z")

</div>

Was able to get everything but the access map and data volume visualizations working.

Not sure how to edit the JSON to use the split lat/long for the map (old version used `nginx.access.geoip.location`) and am not able to use `nginx.access.body_sent.bytes` as a sum-able item.

Still wondering if maybe I am or have done something wrong.

 ![Filebeat_Nginx__Overview-_Kibana](https://us1.discourse-cdn.com/elastic/original/3X/1/c/1c75fa5fc6a892da6b1c374da1d6cf4dc049e9a9.png)

---

<div class="post-metadata">

### Author: ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [June 15, 2018, 4:07pm UTC](https://discuss.elastic.co/t/dashboards-and-visualizations-seem-out-of-date/136112/4 "2018-06-15T16:07:01Z")

</div>

I've tested with the latest 6.3.0 release of the stack and I don't run into this issue and looking at your ES error it looks like an error with _fielddata_, but we don't enable it for any nginx fields.

Can you gist your mapping? [http://localhost:9200/filebeat\*/\_mapping](http://localhost:9200/filebeat*/_mapping) for this index?

---

<div class="post-metadata">

### Author: ![CW360\_Michael](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cw360_michael/32/31437_2.png) [@CW360\_Michael](https://discuss.elastic.co/u/CW360_Michael)
#### Post date: [June 15, 2018, 4:51pm UTC](https://discuss.elastic.co/t/dashboards-and-visualizations-seem-out-of-date/136112/5 "2018-06-15T16:51:20Z")

</div>

@pierhugues thanks for the quick follow-up!

Here's the Gist obtained from Dev Tools \> Console \> `GET _filebeat*/_mapping`: [https://gist.github.com/ActionScripted/93c8bfd299006af92135e0630f55fee9](https://gist.github.com/ActionScripted/93c8bfd299006af92135e0630f55fee9)

(When we moved to 6.3, we cleared old 6.2.4 indices.)

---

<div class="post-metadata">

### Author: ![CW360\_Michael](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cw360_michael/32/31437_2.png) [@CW360\_Michael](https://discuss.elastic.co/u/CW360_Michael)
#### Post date: [June 19, 2018, 8:56pm UTC](https://discuss.elastic.co/t/dashboards-and-visualizations-seem-out-of-date/136112/6 "2018-06-19T20:56:05Z")

</div>

After getting annoyed with the constant errors, wiped everything out and started fresh. Removed all Kibana dashboards and visualizations along with all Filebeat and Kibana indices (including config ones).

Once all Kibana and Filebeat-related data had been purged from ES, changed Filebeat config to use ES instead of Logstash and re-ran Filebeat setup (`filebeat setup`).

Not sure what went wrong where. Maybe we did the upgrade out of order or something. Now that we completely wiped Kibana and Filebeat and re-setup Filebeat things are working as expected without issue.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 17, 2018, 8:56pm UTC](https://discuss.elastic.co/t/dashboards-and-visualizations-seem-out-of-date/136112/7 "2018-07-17T20:56:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
