[Metricbeat Docker] Overview ECS is showing no data and error: [esaggs] > "field" is a required parameter

[Simon_Becker]

Hello,

I am using Metricbeat in docker to monitor my systems Metrics as well as my docker metrics.
Unfortunately, i get an error in Kibana showing this:

My metricbeat config looks like this:
    metricbeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true

metricbeat.modules:
#- module: nginx
#  enabled: true
#  metricsets: ["stubstatus"]
#  period: 20s
#  hosts: ["http://nginx:80"]
#  server_status_path: "server-status"

- module: docker
  metricsets:
    - "container"
    - "cpu"
    - "diskio"
    - "event"
    - "healthcheck"
    - "info"
    #- "image"
    - "memory"
    - "network"
  hosts: ["unix:///var/run/docker.sock"]
  period: 30s
  enabled: true

- module: system
  metricsets:
    - cpu             # CPU usage
    - load            # CPU load averages
    - memory          # Memory usage
    - network         # Network IO
    - process         # Per process metrics
    - process_summary # Process summary
    - uptime          # System Uptime
    - socket_summary  # Socket summary
    #- core           # Per CPU core usage
    #- diskio         # Disk IO
    #- filesystem     # File system usage for each mountpoint
    #- fsstat         # File system summary metrics
    #- raid           # Raid
    #- socket         # Sockets and connection info (linux only)
  enabled: false
  period: 20s
  processes: ['.*']

  # Configure the metric types that are included by these metricsets.
  cpu.metrics:  ["percentages"]  # The other available options are normalized_percentages and ticks.
  core.metrics: ["percentages"]  # The other available option is ticks.

My Docker Compose file looks like this:

services:
metricbeat:
container_name: metricbeat
build: ${PWD}/config/metricbeat
restart: always
user: root
volumes:
- /proc:/hostfs/proc:ro
- /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
- /:/hostfs:ro
- /var/run:/var/run
networks:
- push-network
command: metricbeat -e -system.hostfs=/hostfs

In discover, I can see the incoming data from my different docker containers:

Does anyone has an idea how to fix this?

Thanks!

[Kaiyan_Sheng]

Sorry for the late response here. Not sure if you already tried removing the index and then restart metricbeat?
You can stop metricbeat, then delete the metricbeat index by going to kibana dev tools:

GET _cat/indices
DELETE metricbeat-8.0.0-2019.11.21-000001

You can also do the same thing to remove template:

GET _cat/templates
DELETE _template/metricbeat-8.0.0             

Then restart metricbeat, that might help resolving this error.

[Simon_Becker]

Thanks for the info, removing the index actually solved the issue.