Discover Menu in Kibana no more sorting by index

Elastic Stack Kibana
1

Hello,

I'm currently using Kibana with Fluentd and Metricbeats.
I have 2 indexes : logstash-* and metricbeat-*

In the Discover menu of Kibana, I have the choice to sort the results by index, but this is not working anymore. I mean, if I chose logstash, I have result from logstash and from metricbeats.
I've try to restart Kibana/Elasticsearch.
I have remove all the indexes to restart from scratch.
I've also check in the Management/Index Patterns and they are both well defined. In the Discover menu, I can check and see that the results have the right index.
When I choose logstash index, I can see in the Available Fields, the ones from metricbeats and it's the same if I choose metricbeats index.

Any idea where it's coming from ?
I have no errors or nothing strange in Kibana's logs

Thank you,
Best Regards,
Aurelie

2

So, you have both index patterns defined in Kibana, and you're saying that you choose the logstash-* pattern on the sidebar, like so:

But, in the documents that are shown below the chart, you see are seeing documents from the metricbeat index?

3

Hello,

Yes, for example if I choose logstash-* pattern on the sidebar, I'm going to see documents from logstash index and from metricbeat index.

Moreover, in the side bar, I can see the fields for metricbeat in the logstash index as unknow, like this :

It's normal that it's unknow because they are not defined in the definition of the logstash index (I've checked). They should just not be there.

Thank you for your help,
Aurelie

4

Wow, very strange. Does refreshing the fields in Management > Index Patterns help?

It sounds like you've looked at [the field mappings] you have in logstash-* indices, but just so I'm clear, if you do, you don't see the beats fields, right?

Also, what version of the stack are you running?

5

Yes that's very strange !
I've done refreshment of the fields a couple times; but it doesn't change anything.
My logstash index is defined as default index, by the way.

Yes in the field mapping of logstash, I don't see the beats fields, and in the field mapping of metricbeats, I don't see the logstash fields. Everything seems right there.

I'm running the 5.2.2 version of the stack and the all stack have the same version.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.