# Metricbeat dashboards doesnot show all data

**URL:** <https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [June 13, 2018, 12:10pm UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712 "2018-06-13T12:10:43Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [June 13, 2018, 12:10pm UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/1 "2018-06-13T12:10:44Z")

</div>

Hey Guys,

I have installed metricbeat in some virtual machines and started sending data to elasticsearch. I have imported default dashboards also for the same.

The problem is, the dashboard is not visualizing all data, instead its showing only for 3 VM's. If i convert the timing to last 7 days its visualizing, but for 15 or 30 mins time category i'm not getting all the data.

Screeenshot FYI...

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/47b1fe5a675feea4824e77c2b967b5de029d1451.png)

Screenshot for 7days

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/9/997648f7b44cfc79bbf133314c53df0f76190215.png)

NOTE : The data is available when i check in discover tab.

Any suggestions?

Thanks  
Gautham

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [June 13, 2018, 12:55pm UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/2 "2018-06-13T12:55:38Z")

</div>

Could you check the timestamps of the data points if they are all as they should be or if there are some offsets? What is the minimum duration to select where all data shows up?

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [June 15, 2018, 7:25am UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/3 "2018-06-15T07:25:02Z")

</div>

@ruflin these servers are from different locations, so the time differs from server to server.

I discover tab i'm able to see the enter is made as per elasticsearch server timing.

Minumum i had set to 15minutes in the dashboard.

Thanks  
Gautham

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [June 15, 2018, 2:46pm UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/4 "2018-06-15T14:46:25Z")

</div>

Which field did you look at for the timestamps?

If I understand it right, with 15 minutes you don't see all the data. What is the minimum you see all data ? For example 3 hours or 24 hours? Or only 7 days?

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [June 18, 2018, 9:33am UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/5 "2018-06-18T09:33:33Z")

</div>

@ruflin when i reduce dthe time to 15mins i get only 2 servers, sometimes 1 server.  
When i use 24 hours or 7 days i'm able to see all the hosts monitored.

Thanks  
Gauti

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [June 19, 2018, 7:13am UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/6 "2018-06-19T07:13:20Z")

</div>

That kind of indicates for me that there is something up with the timestamps / time difference.

I assume you always see the same 1-2 servers in the last 15 minutes? Could you share 1 event for each of this server and 1-2 events of servers that you only see when you set it to 24h?

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [June 21, 2018, 2:42pm UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/7 "2018-06-21T14:42:40Z")

</div>

HI @ruflin yeah u are ryt i always see 1 or 2 servers in last 15mins.......here is the event data.

**Event for last 30mins:**  
@timestamp:June 21st 2018, 18:39:41.083 metricset.module:system metricset.rtt:20,001 metricset.name:process system.process.memory.size:10.695MB system.process.memory.rss.pct:0.22% system.process.memory.rss.bytes:18.418MB system.process.memory.share:0B system.process.ppid:500 system.process.pgid:0 system.process.username:NT AUTHORITY\SYSTEM system.process.pid:616 system.process.name:lsass.exe system.process.state:running

**Event for last 7 days:**  
June 21st 2018, 18:19:34.328 beat.hostname:ITSM @timestamp:June 21st 2018, 18:19:34.328 metricset.rtt:36,132 metricset.name:process metricset.module:system system.process.state:running system.process.pid:3,240 system.process.memory.size:3.9GB system.process.memory.rss.bytes:2.159GB system.process.memory.rss.pct:26.99% system.process.memory.share:0B system.process.cmdline:"D:\BMCSoftware\ARSystem\arserver.exe" --unicode -i "D:\BMCSoftware\ARSystem" -l "C:\Program Files\Common Files\AR System\Licenses\onbmc-s" -m system.process.ppid:3,172 system.process.cpu.total.value:775,883,375 system.process.cpu.total.pct:103.44% system.process.cpu.total.norm.pct:25.86% system.process.cpu.start\_time:June 13th 2018, 00:10:28.197 system.process.name:arserver.exe system.process.pgid:0 system.process.username:NT AUTHORITY\SYSTEM beat.name:ITSM beat.version:6.2.4 \_id:00pkImQBUOoQn\_4AqYAl \_type:doc \_index:metricbeat-6.2.4-2018.06.21 \_score: -

June 21st 2018, 18:20:38.556 beat.hostname:BMCSQL @timestamp:June 21st 2018, 18:20:38.556 metricset.name:memory metricset.module:system system.memory.used.bytes:10.982GB system.memory.used.pct:91.52% system.memory.free:1.018GB system.memory.actual.free:1.018GB system.memory.actual.used.bytes:10.982GB system.memory.actual.used.pct:91.52% system.memory.swap.total:23.997GB system.memory.swap.used.bytes:12.196GB

Thanks  
Gautham

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [June 25, 2018, 10:57am UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/8 "2018-06-25T10:57:52Z")

</div>

So the event you shared under 7 days does not show up in the "last 30 minutes" when you searched for it? But later it shows up with the exact timestamp?

I would like to figure out what it is the minimal period you have to set to see all events. It seems not only with 7 days you see everything but also with 24 hours? What about 1h, 2h ?

Are all your VM's in the same time zone? Do they have different setup?

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [June 25, 2018, 11:29am UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/9 "2018-06-25T11:29:13Z")

</div>

@ruflin Yeah you are rite it shows up with exact time stamp only wen i choose 7 days or more. I'm not getting any details even if i choose 24hr or 1hr or 2hr.

For all these hours 24hr or 1hr or 2hr : I'm getting only one VM.

If i choose 7 days or more : I'll get to see all other vm's.

Few Vm's are running on different time as well.

As a best practice i would like to set a minimal of 15 or 30mins, so that the NOC team can keep watching the server performance.

Thanks  
Gautham

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [July 3, 2018, 9:12am UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/10 "2018-07-03T09:12:15Z")

</div>

The part I'm struggling is that you mentioned in your first post that the data shows up in discovery.

What do you get when you click on a single host that is not shown when you only look at the last 5 minutes and then scroll down to see cpu usage for example? Do you see the CPU usage for all 7 days or is the last part of the visualisation empty? See [here](https://demo.elastic.co/app/kibana#/dashboard/79ffd6e0-faa0-11e6-947f-177f697178b8?_a=(description:'',filters:!(),fullScreenMode:!f,options:(darkTheme:!f,useMargins:!f),panels:!((gridData:(h:3,i:'1',w:6,x:0,y:11),id:'6b7b9a40-faa1-11e6-86b1-cd7735ff7e23',panelIndex:'1',type:visualization,version:'6.2.4'),(gridData:(h:3,i:'2',w:6,x:6,y:5),id:'4d546850-1b15-11e7-b09e-037021c4f8df',panelIndex:'2',type:visualization,version:'6.2.4'),(gridData:(h:3,i:'3',w:6,x:6,y:11),id:'089b85d0-1b16-11e7-b09e-037021c4f8df',panelIndex:'3',type:visualization,version:'6.2.4'),(gridData:(h:3,i:'4',w:6,x:0,y:8),id:bfa5e400-1b16-11e7-b09e-037021c4f8df,panelIndex:'4',type:visualization,version:'6.2.4'),(gridData:(h:3,i:'5',w:6,x:6,y:14),id:e0f001c0-1b18-11e7-b09e-037021c4f8df,panelIndex:'5',type:visualization,version:'6.2.4'),(gridData:(h:3,i:'6',w:6,x:0,y:14),id:'2e224660-1b19-11e7-b09e-037021c4f8df',panelIndex:'6',type:visualization,version:'6.2.4'),(gridData:(h:3,i:'7',w:6,x:0,y:5),id:ab2d1e90-1b1a-11e7-b09e-037021c4f8df,panelIndex:'7',type:visualization,version:'6.2.4'),(gridData:(h:3,i:'8',w:6,x:6,y:8),id:'4e4bb1e0-1b1b-11e7-b09e-037021c4f8df',panelIndex:'8',type:visualization,version:'6.2.4'),(gridData:(h:2,i:'9',w:2,x:4,y:1),id:'26732e20-1b91-11e7-bec4-a5e9ec5cab8b',panelIndex:'9',type:visualization,version:'6.2.4'),(gridData:(h:2,i:'10',w:2,x:0,y:1),id:'83e12df0-1b91-11e7-bec4-a5e9ec5cab8b',panelIndex:'10',type:visualization,version:'6.2.4'),(gridData:(h:2,i:'11',w:2,x:2,y:1),id:d3166e80-1b91-11e7-bec4-a5e9ec5cab8b,panelIndex:'11',type:visualization,version:'6.2.4'),(gridData:(h:2,i:'12',w:2,x:6,y:1),id:'522ee670-1b92-11e7-bec4-a5e9ec5cab8b',panelIndex:'12',type:visualization,version:'6.2.4'),(gridData:(h:2,i:'13',w:2,x:8,y:1),id:'1aae9140-1b93-11e7-8ada-3df93aab833e',panelIndex:'13',type:visualization,version:'6.2.4'),(gridData:(h:2,i:'14',w:4,x:8,y:3),id:'34f97ee0-1b96-11e7-8ada-3df93aab833e',panelIndex:'14',type:visualization,version:'6.2.4'),(gridData:(h:1,i:'16',w:6,x:0,y:0),id:System-Navigation,panelIndex:'16',type:visualization,version:'6.2.4'),(gridData:(h:2,i:'21',w:2,x:0,y:3),id:'19e123b0-4d5a-11e7-aee5-fdc812cc3bec',panelIndex:'21',type:visualization,version:'6.2.4'),(gridData:(h:2,i:'22',w:2,x:2,y:3),id:d2e80340-4d5c-11e7-aa29-87a97a796de6,panelIndex:'22',type:visualization,version:'6.2.4'),(gridData:(h:2,i:'23',w:2,x:6,y:3),id:'825fdb80-4d1d-11e7-b5f2-2b7c1895bf32',panelIndex:'23',type:visualization,version:'6.2.4'),(gridData:(h:2,i:'25',w:2,x:10,y:1),id:'96976150-4d5d-11e7-aa29-87a97a796de6',panelIndex:'25',type:visualization,version:'6.2.4'),(gridData:(h:3,i:'27',w:6,x:0,y:17),id:'99381c80-4d60-11e7-9a4c-ed99bbcaa42b',panelIndex:'27',type:visualization,version:'6.2.4'),(gridData:(h:3,i:'28',w:6,x:6,y:17),id:c5e3cf90-4d60-11e7-9a4c-ed99bbcaa42b,panelIndex:'28',type:visualization,version:'6.2.4'),(embeddableConfig:(vis:(defaultColors:('0%20-%20100':'rgb(0,104,55)'))),gridData:(h:2,i:'29',w:2,x:4,y:3),id:'590a60f0-5d87-11e7-8884-1bb4c3b890e4',panelIndex:'29',type:visualization,version:'6.2.4'),(gridData:(h:1,i:'30',w:6,x:6,y:0),id:'3d65d450-a9c3-11e7-af20-67db8aecb295',panelIndex:'30',type:visualization,version:'6.2.4')),query:(language:lucene,query:(query_string:(analyze_wildcard:!t,query:'beat.name:%22gke-prod-demo-elastic--default-pool-2-6c749820-w1w7%22'))),timeRestore:!f,title:'%5BMetricbeat%20System%5D%20Host%20overview',viewMode:view)&_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-4h,mode:quick,to:now))) as an example.

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [July 4, 2018, 6:14am UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/11 "2018-07-04T06:14:18Z")

</div>

hey @ruflin when i choose single host it doesnot have any information, like all the metrics shows 0% except the process count.

Due to some other issue i ended up rebooting my clutser last night, post that i was able to get the data in dashboard properly,

here is the screenshot for 15mins data

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/3/a38c46f220a57cadcdec4cd3d89b7d261c02d95f.png)

Was just wondering in case the same issue arise again, where should i need to look or should i need to restart cluster everytime when such issue happens.

Thanks  
Gautham

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [July 9, 2018, 8:39am UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/12 "2018-07-09T08:39:23Z")

</div>

I really have a hard time to understand on what happened here. A cluster restart should definitively not be needed. As after your cluster restart it seems all the data showed up, not only since the restart so all the data was there all the time as you described in the beginning.

I'm happy it works now, in case it breaks again, lets investigate further.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2018, 8:39am UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712/13 "2018-08-06T08:39:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
