Kibana hashboards empty

[lcui_dxc (Li Cui)]

Hello,

I set up ELK and beats... Elasticsearch on one node, and Logstash and Kibana on another node.
Also, we have filebeat, metricbeat, auditbeat, packetbeat, and winlogbeat from remote servers sending logs/metrics to Logstash and output to elasticseach. All dashboards were defaults. We noticed, many of the hashboards are empty only "Metricbeat systom/host..." with contents... I thought some filebeat hashboard should have contents too because I can see the filebeat is sending log events to Kibana..

Is there anything we did wrong so those dashboards are empty?

Thank you very much.

[bhavyarm]

Hi,

Did you follow the procedure here to set up the dashboards and index beats data into ES/logstash?
For example for metricbeats: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-configuration.html
https://www.elastic.co/guide/en/beats/metricbeat/current/load-kibana-dashboards.html

Second step: can you please check if your es has data by doing _cat/indices?

Third step: are you querying on the time period where there is data in elasticsearch?

Thanks,
Bhavya

[lcui_dxc (Li Cui)]

Thank you...

I tried the following;

1. re-enabled the modules.
2. curl -X GET https://:9200/_cat/indices
   Didn't work, as we have SSL/TLS set on elasticsearch.
   Tried: using --cacert option, no luck.
3. sudo metricbeat setup --dashboards (on one of our metricbeat server)
   Loading dashboards (Kibana must be running and reachable)
   Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: Error creating Kibana client: fail to get the Kibana version: HTTP GET request to /api/status fails: fail to execute the HTTP GET request: Get http://:5601/api/status: EOF. Response:

I saw those dashboard on Kibana, just wonder why they are empty.... (some of them with contents such as metricbeat system overview, host overview, but nothing on any filebeat dashboards...).

Any ideas please?

Thank you very much.

[bhavyarm]

Hi,

From your output it looks like Kibana isn't reachable.

So in metricbeat.yml - you need to configure the kibana end point and add elasticsearch user name and password. Look for the following in your yml

setup.kibana:
host: "mykibanahost:5601"

output.elasticsearch:

Array of hosts to connect to.

hosts: ["localhost:9200"]

Optional protocol and basic auth credentials.

#protocol: "https"
#username: "elastic"
#password: "changeme"

Also you might need to add ssl information in there too.

Hope this helps.

Thanks,
Bhavya

[lcui_dxc (Li Cui)]

Hello there,

I set up another ELK (E and K on one node, L on another) and a linux server with filebeat and metricbeat on.
I can see the log events from filebeat and metricbeats streaming to Kibana/Discover. I dropped the original indexes as they didn't work for the dashboard, and then
I followed the steps to set up filebeat and metricbeat dashboards and set up the index templates for both as well, all went fine.
curl -X GET http://:9200/_cat/indices returned a lot of indexes all are open.But when check on the filebeat system pverview dashbord and other filebeat dashboards. I got:

" Could not locate that index-pattern (id: filebeat-*), click here to re-create it"

This is not link for me to click...

I know someone hit the same or similar issues before. but I didn't see a clear solution...
Our ELK and BEATs are all on v6.3.2. Could you please help me with this?

Thanks a lot

Li

[lcui_dxc (Li Cui)]

Hello there,

Here is what I did:

curl -X GET http://:9200/_cat/indices | grep .kibana

And there was only one .kibane index. I grabbed the ID for this .kibana index.
And deleted the filebeat-* index and recreated it with the same index name and the ID from .kibana.
Still I have the same problem...
" Could not locate that index-pattern (id: filebeat-*), click here to re-create it"

Can somone please help?

Thank you very much.