Kubernetes Infrastructure View - No Entries

Elastic Stack Kibana
1

Hi,

I've just upgraded to Kibana 5.0 and I was looking to try out the Infrastructure view however Kibana is reporting that there are no metrics indices present: Looks like you don't have any metrics indices.

I currently have Filebeat deployed scraping a whole bunch of container logs using the Kubernetes autodiscover (Sending to index kubernetes-*), and I have Metricbeat collecting just Kubernetes events (Sending to index kubernetes-*):

- module: kubernetes
  metricsets:
    - event

(I've tried sending the events to their own index too just in case that was a requirement).

Is it required that metricbeat is also collecting all other Kubernetes metrics for these to be viewable or should just events be sufficient?

Thanks!

2

Hello,

Yes you definitely need metricbeats enabled on your kubernetes deployments to be able to view it in infrastructure.


https://www.elastic.co/docker-kubernetes-container-monitoring

Let me know if it doesn't help.

Thanks,
Bhavya

3

Thanks @bhavyarm

I was hoping I'd be able to see all the pods based on the data scraped by the events metricset, even if we're not scraping cpu, network etc. metrics, and from that view be able to click into a namespace or pod and see the relevant events.

From what I've got working so far, the only pods that show up in the Infrastructure view are those that have logs sent to Elasticsearch via Filebeat (We only ship a handful of logs across).

Looking at some of the articles online it seems that events aren't exposed in the Infrastructure GUI anywhere anyway, is this the case?

Cheers!

4

Hello,

You need to enable kubernetes for metricbeats to able to get those metrics: https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-kubernetes.html

I am also tagging our infra devs here.
@skh @weltenwort can we please get some help?

Thanks,
Bhavya

5

Yes, this is true.

6

@Evesy For this UI to work you need to enable both the system module and kubernetes modules on the host (and pods). Also the index templates are important because they setup the mappings that the application expects. The Kubernetes visualization relies on both the metric field (eg. kubernetes.pod.cpu.usage.node.pct for CPU metric) being present and the pod identification field (which is kubernetes.pod.name). Without those two fields we can't create the query and aggregations to return the data for the CPU metric; the same holds true for the rest of the metrics. If kubernetes.namespace and kubernetes.node.name are not available you won't be able to use the grouping features.

It's probably not impossible to coerce the data to look like what we expect but it's gonna take some trial and error and looking at the UI source code a bit. Which is why I would recommend just using Metricbeat because the UI is design to just work with that out of the box.

Side note: We are changing the Kubernetes and Docker fields in 6.6 to kubernetes.pod.uid and docker.container.id respectively. So if you decided to coerce the data, you will need to do more work every time you upgrade and something changes.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.