Kibana Uptime (built-in dashboard)

[Ryan_Clark]

Setup:
ELK with heartbeat v6.7.1
Heartbeat configured to ping 300+ hosts

Problem:
In the uptime section in Kibana, it shows me my total hosts count, up count, and down count (with accurate numbers) but in the monitoring status visualization, it only shows me a maximum of 50 hosts. Why is it not showing me the status of all 300+ hosts?

I tried searching to see if anyone had the same issue and I'm not finding anything.

[joshdover]

The Uptime and Monitoring apps use different data sources to display their data.

Uptime utilizes data from Heartbeat instances running on any server you install Heartbeat on while Monitoring only displays data for the Elastic Stack's internal monitoring metrics for Kibana and Elasticsearch nodes. You won't see any data from your other servers in the Monitoring app.

Does this answer your question?

[Ryan_Clark]

No, sorry I didn't explain myself too well. I'm not referring to the "monitoring" section of kibana. I'm referring to the "uptime" section of kibana.

I have heartbeat installed on my ELK server and it is configured to ping 300+ hosts and send the data directly to elasticsearch over 127.0.0.1. This works. I get data in the uptime section.

However in the uptime section, the "monitor status" section will only show me 50 hosts max. The "Endpoint Status" shows me the total number of systems and the up/down count and these are correct numbers. I just seem to only be getting a subset of the systems in the other visualizations.

Is there a way to configure kibana to show all the hosts in the "monitor status" section?

I can't send you a picture of the actual server because it's in a closed environment but here is a sample from my testbed (but I don't have more than 50 hosts there....).

[joshdover]

Got it, that makes more sense. I'm not sure if this is a limitation of Uptimes initial Beta release or if that's a bug. @jkambic can you provide more information here?

[jkambic (Justin Kambic)]

Hi @Ryan_Clark; at the moment the table is limited to 50 items. This is due to some architectural limitations caused by the way Heartbeat currently indexes its data. We're aware this is a limitation for our users, and we have it on our roadmap to adjust to the issue.

You could try taking advantage of filters if any of your monitors of interest are distinguishable. If you have further questions please feel free to ask, thank you for your feedback!

[Ryan_Clark]

OK, thanks. Do you know if I would have the same limitation making custom dashboards from the heartbeat data (i.e. if I wanted to status all 300+ of my hosts)?

[jkambic (Justin Kambic)]

Hey @Ryan_Clark - no you won't have the same limitation. You can do a basic terms agg combined with a top_hits to get the statuses of all your monitors at once.

I'm working on optimizing the logic and queries we are using to build that table to improve the UX for future releases.