# Metricbeat does not write data to elasticsearch

**URL:** <https://discuss.elastic.co/t/metricbeat-does-not-write-data-to-elasticsearch/147488>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [September 6, 2018, 3:54am UTC](https://discuss.elastic.co/t/metricbeat-does-not-write-data-to-elasticsearch/147488 "2018-09-06T03:54:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![zozo6015](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zozo6015/32/12117_2.png) [@zozo6015](https://discuss.elastic.co/u/zozo6015)\
**Post date:** [September 6, 2018, 3:54am UTC](https://discuss.elastic.co/t/metricbeat-does-not-write-data-to-elasticsearch/147488/1 "2018-09-06T03:54:38Z")

</div>

Hello,

I have a newly installed metricbeat with the latest version elasticsearch upgraded to the latest version. I started metricbeat I can see in the logs that it's gathering data however the data is not loaded into elasticsearch. The metricbeat node can reach the elasticsearch without problems therefore it's not related to networking.

Also I see no errors at all in the logs while I am having debugging enabled.

Regards,  
Peter

---

<div class="post-metadata">

**Author:** ![zozo6015](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zozo6015/32/12117_2.png) [@zozo6015](https://discuss.elastic.co/u/zozo6015)\
**Post date:** [September 6, 2018, 4:49am UTC](https://discuss.elastic.co/t/metricbeat-does-not-write-data-to-elasticsearch/147488/2 "2018-09-06T04:49:01Z")

</div>

It seam that it's config path did not pick up the modules. After hardcoding it I can see some data in the logs however I still don't see the indexes created in elasticsearch and therefore still no data in it. In the logs I can see the following warnings:

```auto
2018-09-06T04:44:57.462Z	WARN	elasticsearch/client.go:520	Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbedc4a121412cd0a, ext:22544284687, loc:(*time.Location)(0x37d2d20)}, Meta:common.MapStr(nil), Fields:common.MapStr{"fields":common.MapStr{"dc":"NV", "env":"nyc", "region":"America"}, "beat":common.MapStr{"name":"dev-vmnvapp01-1c", "hostname":"dev-vmnvapp01-1c", "version":"6.4.0"}, "host":common.MapStr{"name":"dev-vmnvapp01-1c.l"}, "metricset":common.MapStr{"name":"process", "module":"system", "rtt":165069}, "system":common.MapStr{"process":common.MapStr{"username":"root", "pid":29061, "state":"sleeping", "cpu":common.MapStr{"system":common.MapStr{"ticks":0x0}, "total":common.MapStr{"ticks":0x0, "value":0, "pct":0, "norm":common.MapStr{"pct":0}}, "start_time":common.Time{wall:0x0, ext:63671803543, loc:(*time.Location)(nil)}, "user":common.MapStr{"ticks":0x0}}, "fd":common.MapStr{"open":0x0, "limit":common.MapStr{"soft":0x400, "hard":0x1000}}, "pgid":0, "name":"kworker/0:2", "ppid":2, "memory":common.MapStr{"size":0x0, "rss":common.MapStr{"bytes":0x0, "pct":0}, "share":0x0}}}, "tags":[]string{"jetty", "web-tier"}}, Private:interface {}(nil)}, Flags:0x0} (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [doc]: Mapping definition for [system] has unsupported parameters: [properties : {ticks={type=long}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [system] has unsupported parameters: [properties : {ticks={type=long}}]"}}

```

any idea what it can be?

---

<div class="post-metadata">

**Author:** ![lk95jofr](https://avatars.discourse-cdn.com/v4/letter/l/ee59a6/32.png) [@lk95jofr](https://discuss.elastic.co/u/lk95jofr)\
**Post date:** [September 6, 2018, 9:39am UTC](https://discuss.elastic.co/t/metricbeat-does-not-write-data-to-elasticsearch/147488/3 "2018-09-06T09:39:24Z")

</div>

We had the same issue with metricbeat-6.4.0. Go back to 6.3.0 solved it.  
The differnce in the logs is that on 6.3.0 you can see that metricbeat do a connection to the elastic-server. That was never shown in the 6.4.0 logs.  
So either it is the same issue as the modules.d end up in the wrong place or this is a new bug.

---

<div class="post-metadata">

**Author:** ![zozo6015](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zozo6015/32/12117_2.png) [@zozo6015](https://discuss.elastic.co/u/zozo6015)\
**Post date:** [September 6, 2018, 10:46am UTC](https://discuss.elastic.co/t/metricbeat-does-not-write-data-to-elasticsearch/147488/4 "2018-09-06T10:46:26Z")

</div>

Downgrading to 6.3.0 solved the issue. Any version higher than that was giving the same warning. I would like to have this fixed on the current version however to have everything on the same level of software.

---

<div class="post-metadata">

**Author:** ![lvg](https://avatars.discourse-cdn.com/v4/letter/l/e68b1a/32.png) [@lvg](https://discuss.elastic.co/u/lvg)\
**Post date:** [September 12, 2018, 4:32am UTC](https://discuss.elastic.co/t/metricbeat-does-not-write-data-to-elasticsearch/147488/5 "2018-09-12T04:32:24Z")

</div>

Also the logstash output has the same issues. Version 6.3.2 works fine, in 6.4.0 no connections are made, even tcpdump on de metricbeat doesn't show any outgoing packets!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 15, 2018, 1:30pm UTC](https://discuss.elastic.co/t/metricbeat-does-not-write-data-to-elasticsearch/147488/8 "2018-10-15T13:30:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.