Metricbeat Index pattern

Elastic Stack Beats
1

Hello.
I have noticed some issues with my metricbeat dashboard.
I installed metricbeat 7.14 in 57 hosts before Christmas and the dashboard worked fine.
Went to Christmas holidays and came back with noticing an error message saying "could not locate that index pattern (id:metricbeat-*), click here to re-create it"
It seems that one of my colleagues had during the holidays installed metricbeat 7.15.2 in new hosts with the .msi file extension.
And I think that there might be a issue with the 7.14 and 7.15.2 templates, am I wrong and how can I fix the issue?

Thanks in advance

2

Hi,

I'm not convinced if you should mix versions of templates with Beats. If your colleague started updating metricbeat apps, maybe it's worth reinstalling new templates?

3

I learn this hard way as well.

once your friend install newer version, your alias of metricbeat now point to metricbeat-7.15.2 and all your client might be trying to write to metricbeat-7.14 which is now readonly index.

run this on dev tool GET _cat/aliases and it will show you where your metricbeat alias is pointing to.

There are two way you can fix this.

  1. upgrade all client to same version and it will start.
  2. longer process, you stop all client. remove 7.15.2 template, ilm, index. recreate aliases and point back to last 7.14 index, make that index writable. and start your client
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.