I set up ELK and beats... Elasticsearch on one node, and Logstash and Kibana on another node.
Also, we have filebeat, metricbeat, auditbeat, packetbeat, and winlogbeat from remote servers sending logs/metrics to Logstash and output to elasticseach. All dashboards were defaults. We noticed, many of the hashboards are empty only "Metricbeat systom/host..." with contents... I thought some filebeat hashboard should have contents too because I can see the filebeat is sending log events to Kibana..
Is there anything we did wrong so those dashboards are empty?
curl -X GET https://:9200/_cat/indices
Didn't work, as we have SSL/TLS set on elasticsearch.
Tried: using --cacert option, no luck.
sudo metricbeat setup --dashboards (on one of our metricbeat server)
Loading dashboards (Kibana must be running and reachable)
Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: Error creating Kibana client: fail to get the Kibana version: HTTP GET request to /api/status fails: fail to execute the HTTP GET request: Get http://:5601/api/status: EOF. Response:
I saw those dashboard on Kibana, just wonder why they are empty.... (some of them with contents such as metricbeat system overview, host overview, but nothing on any filebeat dashboards...).
I set up another ELK (E and K on one node, L on another) and a linux server with filebeat and metricbeat on.
I can see the log events from filebeat and metricbeats streaming to Kibana/Discover. I dropped the original indexes as they didn't work for the dashboard, and then
I followed the steps to set up filebeat and metricbeat dashboards and set up the index templates for both as well, all went fine.
curl -X GET http://:9200/_cat/indices returned a lot of indexes all are open.But when check on the filebeat system pverview dashbord and other filebeat dashboards. I got:
I know someone hit the same or similar issues before. but I didn't see a clear solution...
Our ELK and BEATs are all on v6.3.2. Could you please help me with this?
curl -X GET http://:9200/_cat/indices | grep .kibana
And there was only one .kibane index. I grabbed the ID for this .kibana index.
And deleted the filebeat-* index and recreated it with the same index name and the ID from .kibana.
Still I have the same problem...
" Could not locate that index-pattern (id: filebeat-*), click here to re-create it"
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.