Index creation time missing in `index` metricset

Elastic Stack Beats
1

Hi,

I'm trying to build a dashboard to gather all the metrics of my Elastic Stack environment using metricbeat data.

Using the index metricset in metribeat I've seen that there are missing information as index_creation_time reported instead in .monitoring-es* indices.

I want to show, in the dashboard, the metrics of the indices created "today" but without the index_creation_time field is impossible to achieve without further operation on the metricbeat index.

Is possible to retrieve this info without manipulating or enriching the data with logstash/ingest pipelines?

Thank you very much.

Alessio

2

This information should be in index settings. Could you please use the API to review these settings?

BTW This is ES related issue not Beats.

3

Thank you for the reply.

In order to build a simple metric visualization with metricbeat data, that shows how many indices have been created today, I need a field in the metricbeat event that says when the indices have been created, but this specific field is not present.
This is an example of a REAL metricbeat event

{
    "@timestamp": "2017-10-12T08:05:34.853Z",
    "beat": {
        "hostname": "host.example.com",
        "name": "host.example.com"
    },
    "elasticsearch": {
        "cluster": {
            "id": "UziYVLPkTTmCzccc6102Bg",
            "name": "elasticsearch"
        },
        "index": {
            "name": "filebeat-7.0.0-alpha1-2018.05.09",
            "total": {
                "docs": {
                    "count": 1,
                    "deleted": 0
                },
                "segments": {
                    "count": 1,
                    "memory": {
                        "bytes": 6983
                    }
                },
                "store": {
                    "size": {
                        "bytes": 19326
                    }
                }
            }
        }
    },
    "metricset": {
        "host": "127.0.0.1:9200",
        "module": "elasticsearch",
        "name": "index",
        "rtt": 115
    },
    "service": {
        "name": "elasticsearch"
    }
}

This is an example of a what I would have in a metricbeat event

    "@timestamp": "2017-10-12T08:05:34.853Z",
    "beat": {
        "hostname": "host.example.com",
        "name": "host.example.com"
    },
    "elasticsearch": {
        "cluster": {
            "id": "UziYVLPkTTmCzccc6102Bg",
            "name": "elasticsearch"
        },
        "index": {
            "created_at":"2017-10-11T08:05:34.853Z"
            "name": "filebeat-7.0.0-alpha1-2018.05.09",
            "total": {
                "docs": {
                    "count": 1,
                    "deleted": 0
                },
                "segments": {
                    "count": 1,
                    "memory": {
                        "bytes": 6983
                    }
                },
                "store": {
                    "size": {
                        "bytes": 19326
                    }
                }
            }
        }
    },
    "metricset": {
        "host": "127.0.0.1:9200",
        "module": "elasticsearch",
        "name": "index",
        "rtt": 115
    },
    "service": {
        "name": "elasticsearch"
    }
}

Is the same event but in the index object there a created_at field.

I apologize if I didn't explain properly my context.

Thank you very much again.

4

How about this? http://localhost:9200/_cat/indices?h=i,creation.date.string

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.