How to disable analysis of beat.name and other starting issues

Elastic Stack Beats
1

Hello TopBeat Community,

I have configured topbeats to send metrics from my local Ubuntu machine to my Elastic Cloud cluster and installed the beats dashboards.

However I see various "problems" with the beats dashboard I was hoping for some advice on:

  1. The beat.name value for my local machine gets analysed and my machine name "bon-pc" shows up as "bon" and "pc", can I disable analysis of this field in the topbeat.template.json?
  2. Much of the dashboard appears simply not to work, see screenshot below. Am I missing something? In the two right-hand visualisations the key values seem to be garbage...

beats-dash.png1904×1064 64.7 KB

I understand that I can send topbeats data through logstash, is this generally recommended? Is it likely to improve my situation?

Appreciate any help!

2

Did you install the index template? The template marks the beat.* fields as not analyzed. https://www.elastic.co/guide/en/beats/topbeat/current/topbeat-template.html#load-template-shell

3

Thank you @andrewkroh, yes I did this by uncommenting the template and path section of the config file.
I have also set overwrite to true as well which cleared all the existing documents but gave the same results.

Should Kibana automatically pick up the the index pattern if the template is working correctly? I had to manually add it.

4

I recommend checking that the template is loaded (GET /_template/topbeat) and that the mappings on the current day index (GET /topbeat-<day>/) . If the template is correctly loaded but the mappings are still wrong, the problem is likely that the index was created before the template was loaded. In that case, you can either delete the index, or wait until the next day for a new index to be created with the correct mappings.

5

This topic was automatically closed after 21 days. New replies are no longer allowed.