Metricbeat data missing from Infrastructure UI - when using Logstash

[Wayne_Taylor]

Hi All, previously we were using metricbeat to ship directly to ES - but recently added logstash listener in middle. This is beats 6.3.2 with Elastic 6.7

After doing so the filebeat data is loading with no issues and shows in the logs UI - but metricbeat indexes are created, values are accurate - but nothing in the UI.

I verified the index patterns are named metricbeat-*

The logstash config is just a simple input and output. No filtering etc.

Any ideas?

Thanks
Wayne

[weltenwort (Felix Stürmer)]

Hi @Wayne_Taylor,

one common pitfall with the metricbeat -> logstash -> elasticsearch setup is, that metricbeat can't automatically install the index templates and ingest pipelines, which ensure correct mappings. The Infrastructure UI relies on those when querying for metrics.

The solution would be to manually install the index template.

(The same is true for filebeat logs, but the Logs UI happens to be a bit more forgiving unless certain filters are used. See Configure Filebeat to use Logstash and Use Logstash pipelines for parsing in the docs.)