I decom'd an old server with an old version of ELK, set up a fresh install of current versions on a clean server, and updated the file & metric beats on a couple clients to test things out.
I let the 2 beats do their index/dashboard/template loads and things seem to have loaded in, but... something seems not quite right.
The index pattern shows the fields with usually the right type but also a bunch of 'unknowns'
Looking at some data in Discover, I am not able to easily add things like 'module' just by clicking on them like I used to be able to do. Instead I have to search for them in the Available Fields list to add them.
But then once added, they don't have any data in them... The data I'm looking for appears in the higher level namespace as just a blob. (i.e. in this example if I wanted a column for metricset.name that showed Filesystem or Network that isn't something I can do anymore)
Or as another more useful field to show as a column, if I wanted hostname as a column I can't get host.name, I can only get host:
