Index fields with keyword

Hi All,

I made upgrade of ELK 7.1.1 to ELK 7.0. I upgraded also one of 10 metrcibeat from 7.1.1 to 7.2.

upgraded host disappear from build in visualize Top Hosts By CPU (Realtime) [Metricbeat System] ECS.

I fouind that it is caused in group by section in By field. There was and it works for all 7.1.1 and now upgraded server have field How to solve this?

default output in metrixbeat is logstash. logstash is configured by ths way:

hosts => [""]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"



You can edit the visualization and change from the to or you can use the mutate filter in Logstash to copy the field to the missing one:

But these would be ugly fixes, i'd recommend you upgrade all metricbeat instancesto the same version and then do the dashboard setup with the new 7.2 dashboards.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.