Metricbeat timestamp mapping as string type, should be date?

Elastic Stack Beats
1

Trying to get started with filebeat and metricbeat I've noticed that filebeat defines @timestamp as type/format date/date while metricbeat does so as string/date (as shown in the kibana index patterns).

Consequently, using Kibana "Discover" doesn't show any data for metricbeat index but for filebeat index. Both indexes are populated and the beats running and connected.

What/ is there something wrong with the metricbeat index definition in v6.1.1?

Thanks,
andreas

PS.: I've not been able though to find out where @timestamp is actually defined per beat type, any hint is appreciated.

2

All beats should have the exact same format for @timestamp. Can you share your configs? Did you load the templates for the beats?

3

After starting from scratch with andig/beats4pi with a "ready" image plus raspi binary I can no longer reproduce this. It happened when I made the entire package, including fields.yml from source.

Is there any build documentation that describes which make targets are required for building the necessary config files apart from make build? Maybe I was ignoring an important step?

4

make update is your most important setup to make sure the full fields.yml is generated.

1 Like
5

This topic was automatically closed after 21 days. New replies are no longer allowed.