Label/legend names are cut off or incomplete

Elastic Stack Kibana
1

I'm fairly new to Kibana and the beats product. I imported in the available dashboards for the beats products. When I view any graphs/metrics, the beat.name seems to be incomplete. For example, if the name is ABC-12345, I will only see 12345 as the label/legend. Is there a way for me to fix this or update?

I'm currently using Kibana 4.3.1 and the latest ES.

2

Providing a screenshot would be helpful :slight_smile:

3

Oops, forgot about that. Here you go...

Screen Shot 2016-01-05 at 1.54.53 PM.png1272×476 79.7 KB

4

It's probably due to the analysis that ES does to field values.
Specifically there is a thing called tokenisation that splits based on a bunch of things like whitespace and dashes. That means that ABC-12345 turns into two tokens, abc (cause it lower cases) and 12345. That's why it's showing as 12345.

Basically what you need to do is use the .raw version of that field to build the viz on.

5

Thanks for your input.

6

I'm getting close but have a new issue.

When I select beat.name, the graph works but I get the original issue.

If I select beat.name.raw the legend is displayed properly now but there is no data displayed. Am I missing something from the mapping?

7

Here is the updated index template used:

{ "template" : "topbeat-*-db*", "mappings": { "system": { "properties": { "@timestamp": { "type": "date", "format": "strict_date_optional_time||epoch_millis" }, "beat": { "properties": { "hostname": { "type": "string", "fields": { "raw" : { "type": "string", "index": "not_analyzed" } } }, "name": { "type": "string", "fields": { "raw" : { "type": "string", "index": "not_analyzed" } } } } }, "count": { "type": "long" }, "cpu": { "properties": { "idle": { "type": "long" }, "iowait": { "type": "long" }, "irq": { "type": "long" }, "nice": { "type": "long" }, "softirq": { "type": "long" }, "steal": { "type": "long" }, "system": { "type": "long" }, "system_p": { "type": "long" }, "user": { "type": "long" }, "user_p": { "type": "long" } } }, "load": { "properties": { "load1": { "type": "long" }, "load15": { "type": "double" }, "load5": { "type": "double" } } }, "mem": { "properties": { "actual_free": { "type": "long" }, "actual_used": { "type": "long" }, "actual_used_p": { "type": "double" }, "free": { "type": "long" }, "total": { "type": "long" }, "used": { "type": "long" }, "used_p": { "type": "double" } } }, "swap": { "properties": { "actual_free": { "type": "long" }, "actual_used": { "type": "long" }, "actual_used_p": { "type": "long" }, "free": { "type": "long" }, "total": { "type": "long" }, "used": { "type": "long" }, "used_p": { "type": "long" } } }, "type": { "type": "string" } } }, "filesystem": { "properties": { "@timestamp": { "type": "date", "format": "strict_date_optional_time||epoch_millis" }, "beat": { "properties": { "hostname": { "type": "string", "fields": { "raw" : { "type": "string", "index": "not_analyzed" } } }, "name": { "type": "string", "fields": { "raw" : { "type": "string", "index": "not_analyzed" } } } } }, "count": { "type": "long" }, "fs": { "properties": { "avail": { "type": "long" }, "device_name": { "type": "string" }, "files": { "type": "long" }, "free": { "type": "long" }, "free_files": { "type": "long" }, "mount_point": { "type": "string" }, "total": { "type": "long" }, "used": { "type": "long" }, "used_p": { "type": "long" } } }, "type": { "type": "string" } } }, "process": { "properties": { "@timestamp": { "type": "date", "format": "strict_date_optional_time||epoch_millis" }, "beat": { "properties": { "hostname": { "type": "string", "fields": { "raw" : { "type": "string", "index": "not_analyzed" } } }, "name": { "type": "string", "fields": { "raw" : { "type": "string", "index": "not_analyzed" } } } } }, "count": { "type": "long" }, "proc": { "properties": { "cpu": { "properties": { "start_time": { "type": "string" }, "system": { "type": "long" }, "total": { "type": "long" }, "user": { "type": "long" }, "user_p": { "type": "long" } } }, "mem": { "properties": { "rss": { "type": "long" }, "rss_p": { "type": "long" }, "share": { "type": "long" }, "size": { "type": "long" } } }, "name": { "type": "string" }, "pid": { "type": "long" }, "ppid": { "type": "long" }, "state": { "type": "string" } } }, "type": { "type": "string" } } } } }

8

Figured out all the issues. I didn't add the beats templates into ES.

9

Woops!