Metricbeat dashboards changed after kibana update

Elastic Stack Beats
1

Hi all,
I have a 3 nodes cluster that was on version 7.1.1 until yesterday.
I updated the cluster performing small steps (7.2-7.3-7.6-7.9) in order to start playing with the new alerting framework.
I use beats to send metrics and logs into logstash piplines, and than ingest data into ES.
For metrics, the metricbeat dashboard (7.1 version) were installed in kibana. As the older version of beats still be compatible with the new stack, I'd not updated them.

Everything seemed to be fine, unless checking metricbeat dashboards I found something strange:

  1. Metricbeat System dashboards have been duplicated with a new set called [Metrics System] (also the id is the same, having system- as prefix)
  2. Visualize inside these dashboards have been updated, making them pointing to a new index pattern metrics-*
  3. New index patterns were set in kibana: logs-* and metrics-*
  4. New ILM policies were set in ES: logs and metrics

I really don't understand why it happened, as I never updated metricbeat, neither I launched the setup command; in addition, there isn't any trace in documentation about these 2 new indexes, that probably will replace filebeat and metricbeat indexes.

There is someone else that faced this issue, or have an explanation for this behaviour?

TY

2

Hi!

I assume it should be added by the Ingest Management feature (https://www.elastic.co/guide/en/ingest-management/current/ingest-management-overview.html). Can you just ignore them and keep working with the normal indexes like metircbeat-* etc?

C.

3

The problem is that, something in the stack inappropriately updated Metricbet system visualize, making them pointing to a new index, that doesn't exist, as my pipelines ingest data into metricbeat-* indexes.

For example:
"[Metricbeat System] Overview ECS" has been duplicated in "[Metrics System] Overview ECS", but the visualize contained are the same, and them have been updated to point to metrics-* pattern. de facto, I had to restore an old version of system dashboards due to this behaviour

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.