Metricbeat does not write data to elasticsearch

[zozo6015 (Peter)]

Hello,

I have a newly installed metricbeat with the latest version elasticsearch upgraded to the latest version. I started metricbeat I can see in the logs that it's gathering data however the data is not loaded into elasticsearch. The metricbeat node can reach the elasticsearch without problems therefore it's not related to networking.

Also I see no errors at all in the logs while I am having debugging enabled.

Regards,
Peter

[zozo6015 (Peter)]

It seam that it's config path did not pick up the modules. After hardcoding it I can see some data in the logs however I still don't see the indexes created in elasticsearch and therefore still no data in it. In the logs I can see the following warnings:

2018-09-06T04:44:57.462Z	WARN	elasticsearch/client.go:520	Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbedc4a121412cd0a, ext:22544284687, loc:(*time.Location)(0x37d2d20)}, Meta:common.MapStr(nil), Fields:common.MapStr{"fields":common.MapStr{"dc":"NV", "env":"nyc", "region":"America"}, "beat":common.MapStr{"name":"dev-vmnvapp01-1c", "hostname":"dev-vmnvapp01-1c", "version":"6.4.0"}, "host":common.MapStr{"name":"dev-vmnvapp01-1c.l"}, "metricset":common.MapStr{"name":"process", "module":"system", "rtt":165069}, "system":common.MapStr{"process":common.MapStr{"username":"root", "pid":29061, "state":"sleeping", "cpu":common.MapStr{"system":common.MapStr{"ticks":0x0}, "total":common.MapStr{"ticks":0x0, "value":0, "pct":0, "norm":common.MapStr{"pct":0}}, "start_time":common.Time{wall:0x0, ext:63671803543, loc:(*time.Location)(nil)}, "user":common.MapStr{"ticks":0x0}}, "fd":common.MapStr{"open":0x0, "limit":common.MapStr{"soft":0x400, "hard":0x1000}}, "pgid":0, "name":"kworker/0:2", "ppid":2, "memory":common.MapStr{"size":0x0, "rss":common.MapStr{"bytes":0x0, "pct":0}, "share":0x0}}}, "tags":[]string{"jetty", "web-tier"}}, Private:interface {}(nil)}, Flags:0x0} (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [doc]: Mapping definition for [system] has unsupported parameters:  [properties : {ticks={type=long}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [system] has unsupported parameters:  [properties : {ticks={type=long}}]"}}

any idea what it can be?

[lk95jofr (Fredrik Jönsson)]

We had the same issue with metricbeat-6.4.0. Go back to 6.3.0 solved it.
The differnce in the logs is that on 6.3.0 you can see that metricbeat do a connection to the elastic-server. That was never shown in the 6.4.0 logs.
So either it is the same issue as the modules.d end up in the wrong place or this is a new bug.

[zozo6015 (Peter)]

Downgrading to 6.3.0 solved the issue. Any version higher than that was giving the same warning. I would like to have this fixed on the current version however to have everything on the same level of software.

[lvg]

Also the logstash output has the same issues. Version 6.3.2 works fine, in 6.4.0 no connections are made, even tcpdump on de metricbeat doesn't show any outgoing packets!