Missing data and a lot of warning and errors when logging to ES

Elastic Stack Beats
1

I have metricbeat 6.2.4 with ES 6.2.4 and my logs are full of

Metricbeat: https://pastebin.com/VyXVYRk5
ES: https://pastebin.com/8514Lcz8

And the data is missing and not showing information regarding some of the statistics.
On average everytime it pushesh to ES metricbeat generate ~8m of log file.

Configuration for metricbeat

metricbeat.config.modules:
path: ${path.config}/modules.d/*.yml

fields:
env: "production"

Auto load the template

setup.template.overwrite: False

Configure elasticsearch cluser for beats

output.elasticsearch:
hosts: [ "10.0.0.200:9200", "10.0.0.92:9200", "10.0.0.93:9200", "10.0.0.94:9200", "10.0.0.199:9200" ]

/etc/metricbeat/modules.d/system.yml

  • metricsets: [cpu, load, memory, network, process, process_summary, core, diskio,
    socket]
    module: system
    period: 30s
    process.include_cpu_ticks: true
    processes: [.*]
  • filesystem.ignore_types: [nfs, smbfs, autofs]
    metricsets: [filesystem, fsstat]
    module: system
    period: 5m
    processors:
    • drop_event.when.regexp: {system.filesystem.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib)($|/)}
  • metricsets: [uptime, raid]
    module: system
    period: 15m
2

What metricbeat template are you using? Did you disable template loading for Beats in general. There seems to be mismatch between the docs you try to ingest and the template.

3

It was on a clean ES installation.
I loaded the templates by using

metricbeat setup

The issue seems to resolved on it's own, now I have a problem with filebeat parsing a time.Time from Golang the logs is full of it.

4

Strange that it resolved itself. Could be that this happened when a new index was created?

For the parsing error: Best open a new discuss issue to not mix different issues in the same topic.

5

Nothing was pushing to ES at the time, I first created the indexes using the setup commands and then started metricbeat.

So yeah it was very strange, about what happened.
But there is no errors in the log at the moment so we will see how it goes.

Regarding the fliebeat yeah I will open a separate issue

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.