# Fresh install, metricbeat data hard to use in Discover

**URL:** <https://discuss.elastic.co/t/fresh-install-metricbeat-data-hard-to-use-in-discover/157147>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [November 17, 2018, 2:53am UTC](https://discuss.elastic.co/t/fresh-install-metricbeat-data-hard-to-use-in-discover/157147 "2018-11-17T02:53:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DPattee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpattee/32/37772_2.png) [@DPattee](https://discuss.elastic.co/u/DPattee)\
**Post date:** [November 17, 2018, 2:53am UTC](https://discuss.elastic.co/t/fresh-install-metricbeat-data-hard-to-use-in-discover/157147/1 "2018-11-17T02:53:20Z")

</div>

I decom'd an old server with an old version of ELK, set up a fresh install of current versions on a clean server, and updated the file & metric beats on a couple clients to test things out.

I let the 2 beats do their index/dashboard/template loads and things seem to have loaded in, but... something seems not quite right.

The index pattern shows the fields with usually the right type but also a bunch of 'unknowns'

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/2/b2a13c6e62c53c0f157ac824108a3396cbcfa433.png)

Looking at some data in Discover, I am not able to easily add things like 'module' just by clicking on them like I used to be able to do. Instead I have to search for them in the Available Fields list to add them.

But then once added, they don't have any data in them... The data I'm looking for appears in the higher level namespace as just a blob. (i.e. in this example if I wanted a column for metricset.name that showed Filesystem or Network that isn't something I can do anymore)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/9/59f2c8062e9f1df103e10e748e46a388e6dfe62b.png)

Or as another more useful field to show as a column, if I wanted hostname as a column I can't get host.name, I can only get host:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/1/f18b49a95f7b0ae4e200f9642d789236d2f3b1ba.png)

---

<div class="post-metadata">

**Author:** ![DPattee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpattee/32/37772_2.png) [@DPattee](https://discuss.elastic.co/u/DPattee)\
**Post date:** [November 24, 2018, 7:07pm UTC](https://discuss.elastic.co/t/fresh-install-metricbeat-data-hard-to-use-in-discover/157147/2 "2018-11-24T19:07:52Z")

</div>

Out of the blue yesterday metrics started showing up the 'old way' with each item appearing in a manner that I can 'click' them... No idea what changed.

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8cb3480834f82a2831000eca37d872a935848e20.png)

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [November 26, 2018, 8:54pm UTC](https://discuss.elastic.co/t/fresh-install-metricbeat-data-hard-to-use-in-discover/157147/3 "2018-11-26T20:54:51Z")

</div>

Hi @DPattee 🙂

Right now, I also don't have a clue about what could be wrong but I'm asking some partners. About your last message, maybe is it an old container (one with the previous version of Metricbeat) the one that was launched? Is it possible that it was cached somehow?

Regards!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 24, 2018, 8:54pm UTC](https://discuss.elastic.co/t/fresh-install-metricbeat-data-hard-to-use-in-discover/157147/4 "2018-12-24T20:54:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
