Heartbeat problem in 7.7.x

Elastic Stack Beats
1

Dear Experts,

I have problem with Heartbeat version when upgrade to 7.7.
In 7.6.2 I have icmp monitor, and the result in the index for rtt was rtt.us, then in 7.7, the rtt.us was missing and change to icmp.rtt.us, this will break the dashboard that I already build to bring the rtt performance of the ICMP monitoring.
Is there any solution that I can upgrade to 7.7 but the rtt.us still filled? I know I can use scripted field, but I don't want to use it because I use another tools, instead of Kibana, to display the dashboard.

Regards,
Fadjar Tandabawana

2

@fadjar340 Maybe you could use the add_field processor?
https://www.elastic.co/guide/en/beats/heartbeat/current/add-fields.html

3

Is it possible to add field from the ingestion index data?
I have no experience to add this add field in heartbeat.

     processor:
        - add_fields:
            fields:
                rtt.us: icmp.rtt.us

Is it looks like above?
I'm afraid the result is like below:

    {
        "rtt.us": "icmp.rtt.us"
    }

Or use copy field ???

    processors:
      - copy_fields:
          fields:
            - from: icmp.rtt.us
              to: rtt.us
          fail_on_error: false
          ignore_missing: true

Please suggest the best solution.

Regards,
Fadjar Tandabawana

4

Any suggestion from Elastic team?

5

Oke...
This configuration shown rtt.us and icmp.rtt.us accordingly...

I'm happy to upgrade to 7.8.0

Regards,
Fadjar Tandabawana

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.