# Kibana stack monitoring all nodes reported to be master

**URL:** <https://discuss.elastic.co/t/kibana-stack-monitoring-all-nodes-reported-to-be-master/310549>\
**Category:** Kibana\
**Tags:** elastic-stack-monitoring\
**Created:** [July 25, 2022, 2:47pm UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-all-nodes-reported-to-be-master/310549 "2022-07-25T14:47:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thuunder7](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thuunder7/32/97482_2.png) [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\
**Post date:** [July 25, 2022, 2:47pm UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-all-nodes-reported-to-be-master/310549/1 "2022-07-25T14:47:34Z")

</div>

Hello,

I recently upgraded my beats, from 7.16.3 to 8.2.3 and after upgrading, for some reason metricbeat is reporting that all elasticsearch nodes are **master**.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/f/4f75a58556748358501ab3e51ae17af625c0b1b0.png)

Additionally metricbeat is also reporting a wrong elasticsearch version.

![image](https://us1.discourse-cdn.com/elastic/original/3X/2/d/2d0d5d25de2afc6e2ea3488678a63a07291d7c0c.png)

Is this a bug?  
Regards

---

<div class="post-metadata">

**Author:** ![cheiligers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheiligers/32/73114_2.png) [@cheiligers](https://discuss.elastic.co/u/cheiligers)\
**Post date:** [July 25, 2022, 8:31pm UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-all-nodes-reported-to-be-master/310549/2 "2022-07-25T20:31:35Z")

</div>

@Thuunder7 did you upgrade your whole stack to 8.2.3? what version is your Elasticsearch and Kibana running on? The metricbeat UI in Kibana shows the data stored in your `metrics-*` elasticsearch indices and if the documents report the same data as what you're seeing in the UI, then there might be something else going on.

---

<div class="post-metadata">

**Author:** ![Thuunder7](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thuunder7/32/97482_2.png) [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\
**Post date:** [July 27, 2022, 6:31pm UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-all-nodes-reported-to-be-master/310549/3 "2022-07-27T18:31:36Z")

</div>

Yes i did upgrade whole stack to 8.2.3. First i upgraded elasticsearch nodes and kibana but i gave two weeks until i decided to upgrade metricbeat and logstash. During those 2 weeks with metricbeat being on version 7.16.3 everything looked fine on Kibana stack monitoring, but when i upgraded metricbeat this "issue" appeared.

I looked into metrics-\* indices but i only have these two:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/9/49802764612952dbccdb405fe9784040d237189b.png)

And as you can see they both have no documents.

---

<div class="post-metadata">

**Author:** ![cheiligers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheiligers/32/73114_2.png) [@cheiligers](https://discuss.elastic.co/u/cheiligers)\
**Post date:** [July 27, 2022, 7:02pm UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-all-nodes-reported-to-be-master/310549/4 "2022-07-27T19:02:19Z")

</div>

@Thuunder7 I've asked the monitoring team to try and help here.

---

<div class="post-metadata">

**Author:** ![miltonhultgren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miltonhultgren/32/100401_2.png) [@miltonhultgren](https://discuss.elastic.co/u/miltonhultgren)\
**Post date:** [July 28, 2022, 6:24am UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-all-nodes-reported-to-be-master/310549/5 "2022-07-28T06:24:26Z")

</div>

@Thuunder7 We've fixed these two bugs in Kibana 8.3!

You can find the related PRs below:

> <https://github.com/elastic/kibana/pull/131194>
>
> fixes #126741
> 
> When using external collection, we were trying to read the Elas…ticsearch version from \`elasticsearch.version\`.
> However, according to the \[module docs\](https://www.elastic.co/guide/en/beats/metricbeat/current/exported-fields-elasticsearch.html) the right field is \`elasticsearch.cluster.stats.state.version\` (which is aliased for \`cluster\_state.version\`).
> 
> But, it seems the Metricbeat module does not actually populate this field, and it might be because the ES APIs aren't so clear about it.
> 
> \`elasticsearch.version\` is populated from the results of \`/\_cluster/state\` which reports \`version\` as a simple integer.
> 
> The response from \`/\_cluster/stats\` reports the version under both \`indices\` and \`nodes\`, both as lists.
> 
> The response from \`/\` reports it under \`version.number\` but with the build type included (8.3.0-SNAPSHOT).
> 
> The version shows up in a few places but not as clearly as the old internal collection documents. 
> As a side question, what is the version of a distributed system? A lot of the version fields in the new API response are arrays since it might be the state during a rollover to contain multiple versions.
> 
> In this PR, I'm resorting to using the first item in \`elasticsearch.cluster.stats.nodes.versions\` as the version to display in the overview.

> <https://github.com/elastic/kibana/pull/131156>
>
> Fixes #126557
> 
> The Metricbeat documents always contain the field \`master\` but …the code only checked for existence of the field, not whether it was true or false. 
> 
> https://www.elastic.co/guide/en/beats/metricbeat/current/exported-fields-elasticsearch.html (search for elasticsearch.node.master)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2022, 6:24am UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-all-nodes-reported-to-be-master/310549/6 "2022-08-25T06:24:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
