Error in index or visualisations for "[Metricbeat System] Overview ECS"

Elastic Stack Beats
2

Hi @bodo.te
Sorry you are having trouble let see if we can get this straightened out. Once we get this straight you only need to setup metricbeat once and you will not need to do the "editing / fixing" you are trying to do.

To me it looks like you loaded the dashboards but not the index template and index pattern which is required to set up the correct mappings (which I suspect is the source of your issues)

The directions have set them up separately but I suggest just using the following command to setup everything at the same time

./metricbeat setup

the above command loads the dashboards index templates index patterns all in one command.

https://www.elastic.co/guide/en/beats/metricbeat/current/command-line-options.html#setup-command

However I suspect that you are in a half set up state at this point and the error about the field data is means the mapping and index patterns are not correct.

Unfortunately to get back in a good state we will need to delete the metricbeat indexes, metricbeat index template, and metricbeat index pattern and then start over by running the command above.

I am assuming this is just test data so that you can delete it....

So here is what we are going to do...

  1. stop all metricbeats on all hosts

  2. Navigate to Kibana / Management / Index Patterns
    And delete the metricbeat index pattern by selecting it then deleting it.

  3. Navigate to Kibana / Dev Tools
    Run the Following 2 commands, it is possible the command will fail because the template does not exist

WARNING This is going to delete the existing metricbeat data do NOT do if your need this data.

DELETE /metricbeat-*

DELETE /_template/metricbeat-7.3.1
  1. Go to your metricbeat host and run

./metricbeat setup

then

./metricbeat -e

  1. Navigate to the Visualizations, you may need to force refresh / reload Kibana but you should see the correct visualizations.

Note the easiest way to get metricbeat or any beat running is just to follow the quickstart guides that are built into Kibana

Example:

http://localhost:5601/app/kibana#/home/tutorial/systemMetrics?_g=()

http://localhost:5601/app/kibana#/home/tutorial_directory?_g=()

Hope this helps