# Marvel only shows data from master node

**URL:** https://discuss.elastic.co/t/marvel-only-shows-data-from-master-node/47354
**Category:** Elasticsearch
**Tags:** elastic-stack-monitoring
**Created:** [April 14, 2016, 7:40am UTC](https://discuss.elastic.co/t/marvel-only-shows-data-from-master-node/47354 "2016-04-14T07:40:20Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![kirnberger](https://avatars.discourse-cdn.com/v4/letter/k/dc4da7/32.png) [@kirnberger](https://discuss.elastic.co/u/kirnberger)
#### Post date: [April 14, 2016, 7:40am UTC](https://discuss.elastic.co/t/marvel-only-shows-data-from-master-node/47354/1 "2016-04-14T07:40:20Z")

</div>

Hi there,

we did an updgrade from ES 2.2.1 -\> ES 2.3.1, Kibana 4.4.2 -\> Kibana 4.5.0 and using the latest Marvel version. Agent is installed on each node (incl. license) and after start of Kibana we only get data from the master node. Same after switching master to different node:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/d/dbe65d50821fd0e771cc13791d51025a09bb8c7b.png)

Can anyone help me, what I have to configure to see data for each node again?

Regards,  
Marcell

---

<div class="post-metadata">

### Author: ![pickypg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pickypg/32/62409_2.png) [@pickypg](https://discuss.elastic.co/u/pickypg)
#### Post date: [April 14, 2016, 3:13pm UTC](https://discuss.elastic.co/t/marvel-only-shows-data-from-master-node/47354/2 "2016-04-14T15:13:42Z")

</div>

Hi Marcell,

This looks to be the same issue as in [All nodes except Master show as "Offline"](https://discuss.elastic.co/t/all-nodes-except-master-show-as-offline/46274/19) .

This is the result of the new node resolver feature not picking up the transport address properly. You can workaround this issue by changing the node resolver to use the node's name as the unique properly rather than the transport address (the default). This is done in the Kibana config (`kibana.yml`):

```auto
marvel.node_resolver: name

```

Given that you do not have have domain names in your transport address, can I have you run this to ensure that the forthcoming fix is enough:

```auto
GET /.marvel-es-1*/node_stats/_search
{
   "size" : 0,
   "aggs" : {
      "nodes" : {
         "date_histogram" : {
            "interval" : "10s",
            "field" : "timestamp",
            "order" : {
               "_key" : "desc"
            },
            "min_doc_count" : 1
         },
         "aggs" : {
            "source_node_name" : {
               "terms" : {
                  "field" : "source_node.name"
               },
               "aggs" : {
                  "source_node_transport_address" : {
                     "terms" : {
                        "field" : "source_node.transport_address"
                     }
                  }
               }
            }
         }
      }
   }
}

```

---

<div class="post-metadata">

### Author: ![kirnberger](https://avatars.discourse-cdn.com/v4/letter/k/dc4da7/32.png) [@kirnberger](https://discuss.elastic.co/u/kirnberger)
#### Post date: [April 15, 2016, 7:14am UTC](https://discuss.elastic.co/t/marvel-only-shows-data-from-master-node/47354/3 "2016-04-15T07:14:22Z")

</div>

Hi Chris,

thanks. The workaround fixed the issue. The search request succeeded and returned plenty of lines:

```auto
"aggregations": {
    "nodes": {
      "buckets": [
        {
          "key_as_string": "2016-04-14T15:51:50.000Z",
          "key": 1460649110000,
          "doc_count": 1,
          "source_node_name": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "elastic04",
                "doc_count": 1,
                "source_node_transport_address": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "key": "elastic04/10.30.0.118:9300",
                      "doc_count": 1
                    }
                  ]
                }
              }
            ]
          }
        },
        {
          "key_as_string": "2016-04-14T15:51:40.000Z",
          "key": 1460649100000,
          "doc_count": 3,
          "source_node_name": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "elastic04",
                "doc_count": 1,
                "source_node_transport_address": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "key": "elastic04/10.30.0.118:9300",
                      "doc_count": 1
                    }
                  ]
                }
              },
              {
                "key": "elastic05",
                "doc_count": 1,
                "source_node_transport_address": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "key": "elastic05/10.30.0.119:9300",
                      "doc_count": 1
                    }
                  ]
                }
              },
              {
                "key": "elastic06",
                "doc_count": 1,
                "source_node_transport_address": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "key": "elastic06/10.30.0.120:9300",
                      "doc_count": 1
                    }
                  ]
                }
              }
            ]
          }
        },
...

```

Hope, the excerpt of the response can help you verifying.

Regards,  
Marcell

---

<div class="post-metadata">

### Author: ![pickypg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pickypg/32/62409_2.png) [@pickypg](https://discuss.elastic.co/u/pickypg)
#### Post date: [April 19, 2016, 5:52pm UTC](https://discuss.elastic.co/t/marvel-only-shows-data-from-master-node/47354/4 "2016-04-19T17:52:06Z")

</div>

Thanks Marcell,

It looks like your issue's cause is the same as the others, which is a great sign.

---

<div class="post-metadata">

### Author: ![kirnberger](https://avatars.discourse-cdn.com/v4/letter/k/dc4da7/32.png) [@kirnberger](https://discuss.elastic.co/u/kirnberger)
#### Post date: [April 20, 2016, 7:53am UTC](https://discuss.elastic.co/t/marvel-only-shows-data-from-master-node/47354/5 "2016-04-20T07:53:33Z")

</div>

Thanks Chris.

PS: Btw, what tags do I have to use in order to format the json I posted ? 😉

---

<div class="post-metadata">

### Author: ![pickypg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pickypg/32/62409_2.png) [@pickypg](https://discuss.elastic.co/u/pickypg)
#### Post date: [April 20, 2016, 2:11pm UTC](https://discuss.elastic.co/t/marvel-only-shows-data-from-master-node/47354/6 "2016-04-20T14:11:57Z")

</div>

Single ` are meant for a single line. You needed to use ``` (on their own lines). Like this:

```  
block  
of  
code  
```

Rather than

`block  
of  
code`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:44pm UTC](https://discuss.elastic.co/t/marvel-only-shows-data-from-master-node/47354/7 "2017-07-06T13:44:08Z")

</div>


