Estrange results in metricbeat docker dashboard

[juanarmentia (Juan)]

Hi,

I have enabled the docker module of metricbeat and the dashboard shows estrange results. In the table of docker containers (left) shows 1 container, while in the number of containers element (right) shows 4 running. Why could happen this?

Thanks in advanced!

[pmercado (PM)]

This does not look consistent.

Can you execute some operations at elasticsearch?
For the same range of time that is showing that data, search uniques container.name you find (this belong to the table visualization).

Then for that same range, get the max of docker.info.containers.running (that would belong to the rightmost visualization.

[juanarmentia (Juan)]

Thanks for the replay! This is what I obtain:

And 'docker ps' command in linux shows only 1 docker.

[pmercado (PM)]

Thanks @juanarmentia,

this looks like an issue interpreting what is being retrieved from the docker socket. Would you mind opening an issue here including this info?

[juanarmentia (Juan)]

I have performed some checks and I see that 'docker info' command returns the information that Kibana shows. So, the problem is not in Metricbeat, but it is in the information that docker returns.

Thanks!

[pmercado (PM)]

Thanks, will check anyway if there is a better way of labeling that visualization metric.