Previously we had a pinned search filter for host.name that would allow our users to pull down and select a host from a list. Now that list is only showing MetricBeat hosts which have the latest 6.0 version of the agent that were installed by developers on a few machines (without coordination with systems group).
Is this expected behavior because the new agents have made new indexes? How do we get our host overview dashboard to show all hosts regardless of their metricbeat version to show in the pull downs?
If I understood correctly, you might have add_host_metadata on your newest Metricbeat configuration files (it was added in 6.3). This feature adds some data, including a host.name key that may override any other.
The index shouldn't have changed, however.
Can you explain the issue a bit more? Is your concern that you had hosts that were monitored in Metricbeat (one or more for each Metricbeat) and now you have only Metricbeat hosts?
Yes, it appears that the newer versions of Metricbeat added some new fields to our data. One of these was the host.name key which was getting overwritten with data from the Metricbeat plugin which broke some of our visualizations/dashboards. We've found a workaround in using beat.hostname in our searches/visualzations for now. Long term we will have to fix our data inputs to not use the conflicting host.name field name.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
