Index_Pattern set to metricbeat-* on sample dashboards

Elastic Stack Beats
1

Hi,

Not sure if this is limited to metricbeat but,

I noticed that in 6.2 that the index_pattern on the default dashboards is set to "index_pattern":"metricbeat-" when in the version 6.1.3 is was set to "index_pattern":"".

Is there anyway i can override this in config or do i need to manually change the templates between adding them to elesticsearch?

Currently I plan to use a custom index pattern to store all beats:

setup.template.name: "dev-metricbeat-%{[beat.version]}"
setup.template.pattern: "dev-*"
setup.dashboards.index: "dev-*"
2

When importing the dashboards, the index-pattern to be used by the dashboards should be defined by setup.dashboards.index.

If you use setup.dashboard.index, is the index-pattern set as you would expect? If not, which Elasticsearch and Kibana versions are you using?

Btw. you should version the template pattern as well. With the template name versioned, you might end up with multiple templates matching a new index name, potentially giving you weird problems/errors on updates.

3

no it doesn't seem to be replacing whats has been set in the template for example when importing the metricbeat-6.2.0-windows-x86_64\kibana\6\dashboard\Metricbeat-system-overview.json.

.\metricbeat setup --dashboards -E output.logstash.enabled=false -E 'output.elasticsearch.index=dev-%{+yyyy-MM-dd}' -E 'output.elasticsearch.hosts=["elastic1.domain.com:9200"]'

I've using 6.2.0 for elasticsearch, kibana, logstash.

4

Sounds like you are hitting this bug: https://github.com/elastic/beats/issues/4345

Can you comment in this ticket with configs and command, so it's clear the problem is not solved in 6.x?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.