Metricbeat Dashboard only some stats working

[rplus (Rasmus Gärdekrans)]

Hi, I've setup metricbeat on a windows server. It currently ships it's logs to logstash and then elastic.

For some reason the deafult metric dashboard only shows some stats:

(Dont worry about the filtering, I only have one host sending metricbeat data).

As shown in the picture there is for instance no CPU usage being shown.
When I look at the CPU Usage Gauge [Metricbeat System] ECS visualization I can see that it expects system.cpu.user.ptc, system.cpu.systems.pct and system.cpu.cores.

I find all those in my discovery tab using index pattern metricbeat-*

The same goes for the other stats not showing, network and disk etc.

I do get _grokparsefailure on my metricbeat data. In my logstash i do grokfiltering on filebeat and winlogdata, but nothing for metricbeat. Could that be the issue?

Appreciate all the help I can get!

//Rasmus

[MarianaD]

hi @rplus,

I have done a quick test on Windows 10:

Without using Logstash between Metricbeat and ES, can you test this scenario as well and let us know if you are able to see the visualizations filling in? It will be easier to exclude LS as the bottleneck.
The TSVB visualization (in most of the cases) will only show the value of the last data and not the data of the selected time range. So, if no documents are found in the last bucket, value will be 0.
I expect the interval of the visualization to be 10s if you query for example:

get metricbeat-*/_search
{
  "query": {
    "term": {
      "metricset.name": {
        "value": "cpu"
      }
    }
  },
  "sort": [
    {
      "@timestamp": {
        "order": "desc"
      }
    }
  ],
  "_source": {
    "includes": [
      "@timestamp"
    ]
  }
}

Do you see a 10s difference between the timestamps?
You mention you get grokparsefailure on your metricbeat data but you don't do any grok processing on the data coming from Metricbeat in LS? Can you provide us with an example of any of those grokparsefailure messages?

[rplus (Rasmus Gärdekrans)]

Hi, Thank you for your reply. It seems to working now. I don't really understand why, because I've have not done any changes.

[MarianaD]

hi @rplus, understood, let know if you manage to reproduce this issue.