Hello if i have multiple systems using metricbeat and all sending to the same Elasticsearch cluster is there a way to use the already made graphs for each different index of metricbeat. Each cluster i am shipping with a different index name.
Are you referring to the Kibana dashboards? You could define a different index-pattern with -i: https://www.elastic.co/guide/en/beats/libbeat/master/import-dashboards.html BTH I'm not 100% sure what will happen if you will load the same visualisations multiple times for different patterns. Never tried it. I worry that some parts will overwrite each other. @monica WDYT?
How do i go about creating the same dashboard but for a different cluster?
Different cluster = different Kibana instance? Then you can just import it there too and use a different elasticsearch target in import_dashboards.
hmm i think i am confused. we have the same ELK cluster but different hosts we want to monitor. I can change that in the imports?
So you have multiple metricbeat instances sending data into one Elasticsearch cluster. You can filter by hosts in Kibana and don't need to import dashboards multiple times.
You mentioned before different cluster so I assume you meant elasticsearch cluster. Is my above assumption now correct?
correct, I was wondering if there is a way to sort by index? I have each set of clusters sending data with a different Index. It seems when creating dashboards it defaults to the Metricbeat Index but there is no way to change that Index.
You can create your own index pattern in Kibana. For example if your indicies are metricbeat-cluster1-* etc. you could create index pattern for each cluster.
What is your end goal? Having dashboards for each cluster? Or being able to view on data for each cluster? Because the second one you could solve with applying filters based on same fields for example. So you still have the overall view but can dig into each (or multiple clusters).
Having dashboards for each cluster based off the index that is passed with metricbeat.
If each "group of machines" (cluster) will have the same dashboards, why do you want to import it multiple times? I think I'm missing something. Is this about different access rights to the data?
the dashboards need to reflect each different cluster. Instead of filtering the data host by host, i wanted to see if there is a way to do it by Index? It seems it just defaults to the metricbeat index everytime.
I am afraid that you are not able to have the same dashboard for multiple indexes in one Kibana instance, as all the dashboard dependecies (searches, visualizations) will be overwritten.
There is not a simple solution that I can think of now. One option would be to import first the dashboards for one index (there is an option to change the default index name in the import script) and then export the dashboards using the python script, and then change manually the name of all the visualizations, searches and dashboards.
Should I set up more than one kibana instance? I'm trying to figure out best solution for this.
Hi all,
I am currently facing a similar issue as kmroz and I thought I would lend my current plan of action which seems promising thus far. Essentially I have different hosts that I all want to use the metricbeat index template, but I do not want them all to be on the same dashboard. I understand there are ways to filter out certain hosts, but I wasn't crazy about the idea of creating a inventive regex every time I added a new host to the metricbeat index. What I decided to do was download the metricbeat template from your github Monica (Here for kmroz) and alter the titles on each visualization and dashboard json as well as altering the title in the index pattern json. I then used the import script to point to my instance of Kibana where I already have metricbeat dashboards running. I ran the script with -i (renaming the index to match the title specified in the pattern json), the -dir (to point to my saved version of the metricbeat template), and the -es (to point to my kibana instance) parameters. This allowed me to use the metricbeat template for my new index without overwriting the original metricbeat index's dashboards and visualizations. Now this took some effort to manually changed the json, but this was only a POC. I plan to programmatically have it alter the titles in the json for any future indicies I may want to add.
If you are using indexes of format metricbeat-cluster1-*, metricbeat-cluster2-*, etc, an option (didn't test this) would be to use the default generated index pattern (metricbeat-* in Kibana) to match all the above. Instead of defining an index pattern in Kibana for each index template, you could define a single index pattern (metricbeat-*) and use it into all visualizations. This way, having a dashboard for all indexes is possible and you can use the filtering capabilities in Kibana to select the data coming from a cluser or another.
Ok thanks @tsullivan93 @monica I will take both of your guys comments into consideration and see which one works out for me. I appreciate the quick responses!
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.