I have an issue during elastic agent evaluation in Elastic Cloud 7.9.3 (Managed EC). I can successfully setup agent on several machines (Windows and Linux) with system and endpoint-security integrations. Data is sent correctly and I can see the data in several elastic-agent dashboard such as "[Metrics System] Overview ECS" dashboard.
I needed to add some metrics that are not available with ingest manager (for example docker module) so I setup a metricbeat client and perform "metricbeat setup" and I see all the Elastic Agent dashboard display no data anymore.
It seems the Metricbeat setup overwrites the dashboard and use metricbeat-* index pattern instead so data from Elastic Agent (metrics-* index pattern) is not displayed anymore.
Is this the expected behavior and how to restore the elastic agent built-in UI as I could not see any option for it?
Good question, I'm not sure about the potential solution but probably Metricbeat has overriden the dashboard when you execute metricbeat setup. Dashboards are a JSON file with a lot of info including an ID and a index pattern to point at. In metricbeat that index pattern is metricbeat-* and in the Agent is metrics-*. The ID's are probably still the same and they got overriden, however I'm just speculating.
As a workaround you can try to setup the agent again and modifying the Metricbeat dashboard id of the dashboard that is being overridden. The dashboard file info is in kibana/7/dashboard folder of Metricbeat
I ended up exporting saved objects from a fresh environment and imported into Kibana. I can now see my data again
I can confirm that Elastic agent create a separate dashboard but for visualization it uses the same visualization Id as metricbeat with different index pattern. Why not use a different visualization Id?
Before elastic agent supports all modules I guess many will use both elastic agent and metricbeats so this could cause similar issue that I had.
Hopefully Elastic will provide a button to reinstall (reset) the agent assets (Especially for system assets) as it is possible to delete/replace/edit the installed saved object but there is no way to restore it.
You are hitting a bug we have in 7.9 where we use the same ids for the visualizations. This should of course not be the case to the dashboards can coexist. Sorry about that.
Interesting idea around the reinstall. We are going with the assumption that in there this is not need but reality shows once again, it is not the case. Could you open a Github issue around this to discuss this a bit broader. Kibana repo would be the right place, feel free to ping me on it.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
