Discover Menu in Kibana no more sorting by index


I'm currently using Kibana with Fluentd and Metricbeats.
I have 2 indexes : logstash-* and metricbeat-*

In the Discover menu of Kibana, I have the choice to sort the results by index, but this is not working anymore. I mean, if I chose logstash, I have result from logstash and from metricbeats.
I've try to restart Kibana/Elasticsearch.
I have remove all the indexes to restart from scratch.
I've also check in the Management/Index Patterns and they are both well defined. In the Discover menu, I can check and see that the results have the right index.
When I choose logstash index, I can see in the Available Fields, the ones from metricbeats and it's the same if I choose metricbeats index.

Any idea where it's coming from ?
I have no errors or nothing strange in Kibana's logs

Thank you,
Best Regards,

So, you have both index patterns defined in Kibana, and you're saying that you choose the logstash-* pattern on the sidebar, like so:

But, in the documents that are shown below the chart, you see are seeing documents from the metricbeat index?


Yes, for example if I choose logstash-* pattern on the sidebar, I'm going to see documents from logstash index and from metricbeat index.

Moreover, in the side bar, I can see the fields for metricbeat in the logstash index as unknow, like this :

It's normal that it's unknow because they are not defined in the definition of the logstash index (I've checked). They should just not be there.

Thank you for your help,

Wow, very strange. Does refreshing the fields in Management > Index Patterns help?

It sounds like you've looked at [the field mappings] you have in logstash-* indices, but just so I'm clear, if you do, you don't see the beats fields, right?

Also, what version of the stack are you running?

Yes that's very strange !
I've done refreshment of the fields a couple times; but it doesn't change anything.
My logstash index is defined as default index, by the way.

Yes in the field mapping of logstash, I don't see the beats fields, and in the field mapping of metricbeats, I don't see the logstash fields. Everything seems right there.

I'm running the 5.2.2 version of the stack and the all stack have the same version.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.