Metricbeats and Kibana

Elastic Stack Beats
1

Working with a fresh installation of Kibana and metricbeats. The latter feeds through logstash.

I've gone through setting up the dashboards multiple times, but keep winding up with errors like the following:

The request for this panel failed
Fielddata is disabled on text fields by default. Set fielddata=true on [beat.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.

and

The request for this panel failed

The aggregations key is missing from the response, check your permissions for this request.

My logstash config looks like the following:

 output {
   elasticsearch {
      hosts => ["localhost:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
   }
}

metricbeats config looks like the following:

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["severname:5046"]

#============================== Dashboards =====================================
setup.dashboards.enabled: true

#setup.dashboards.url:

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  host: "http://servername:5601"

I've deleted the indices and dashboards multiple times, reloaded, still receiving the same errors in dashboards with multiple fields showing similar errors.

Advice is welcome

2

Hi @lgwapnitsky :slightly_smiling_face:

Can you share the command you are using to setup the dashboards. Also any output might be helpful.

Which version of the stack you are using? Do you have X-Pack Security enabled?

Have you read this related issue? Elasticsearch problem, search thread pool rejected

3

Mario-

After some digging, I've exported my json objects, and modified a significant number of fields to now point to .keyword. That seems to be working for now.

Thanks for the pointer to the other article, but different issue for now.

Best regards,
Larry

4

Also, had i followed the instructions, you can't load the templates via logstash. Changed that, too, and it worked :slight_smile:

5

Oh, yeah, I didn't realize that you might be trying that. I'm glad that you fixed it!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.