Fresh install, metricbeat data hard to use in Discover

I decom'd an old server with an old version of ELK, set up a fresh install of current versions on a clean server, and updated the file & metric beats on a couple clients to test things out.

I let the 2 beats do their index/dashboard/template loads and things seem to have loaded in, but... something seems not quite right.

The index pattern shows the fields with usually the right type but also a bunch of 'unknowns'

Looking at some data in Discover, I am not able to easily add things like 'module' just by clicking on them like I used to be able to do. Instead I have to search for them in the Available Fields list to add them.

But then once added, they don't have any data in them... The data I'm looking for appears in the higher level namespace as just a blob. (i.e. in this example if I wanted a column for that showed Filesystem or Network that isn't something I can do anymore)

Or as another more useful field to show as a column, if I wanted hostname as a column I can't get, I can only get host:

Out of the blue yesterday metrics started showing up the 'old way' with each item appearing in a manner that I can 'click' them... No idea what changed.


Hi @DPattee :slight_smile:

Right now, I also don't have a clue about what could be wrong but I'm asking some partners. About your last message, maybe is it an old container (one with the previous version of Metricbeat) the one that was launched? Is it possible that it was cached somehow?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.