Missing index pattern heartbeat-*

Elastic Stack Beats
1

Hi,

I am using ELK 7.9. I have installed and confirmed working fine Winlogbeat, Packetbeat and Auditbeat. But regarding Heartbeat, apparently is working fine, as is communicating with Elasticsearch, but is the only beat that is not creating the it's own index as expected (heartbeat-*). Because of this I cannot use Discovery with Heartbeat, because index is not available. Other queries related cannot be done either.

  • Legacy Index Template heartbeat-7.9.0-* is created
  • Under Index Management is created heartbeat-7.9.0-[date]-000001
  • Under Index Pattern is missing heartbeat-*
  • Under Discovery is missing heartbeat-*

I have ran heartbeat setup several times.

The above issue was also exposed and discussed here, by DanRoscigno, but I did not see the solution. Maybe I missed.

Maybe this is related to another issue I am seeing with heartbeat. Running heartbeat setup should probably be setting up the index pattern heartbeat-* . Instead, it is setting up the index pattern UptimeIndexPattern which does not seem to work with anything other than the Uptime UI (for example, you cannot use it in Discover or Lens).

Is there anything I can do to fix this?

Thank you

2

Hi @ManuelF can you please clarify if you mean heartbeat isn't creating heartbeat-* index pattern or do you mean heartbeat isn't publishing data?

If you want to see heartbeat data in Discover, you can yourself create an index pattern using kibana if data is being published. Also you can use Uptime app to visualize heartbeat data.

Regards

3

Hi @shahzad31,

Thank you for answering. Heartbeat is sending data to Elasticsearch that is only available from Uptime UI, but the index heartbeat-* is not being created and I would like to used like in the past I used to.

Maybe this is related to another issue I am seeing with heartbeat. Running heartbeat setup should probably be setting up the index pattern heartbeat-* . Instead, it is setting up the index pattern UptimeIndexPattern which does not seem to work with anything other than the Uptime UI (for example, you cannot use it in Discover or Lens).

4

Great @ManuelF , you can create that yourself easily, we are not creating an uptime index pattern auto anymore.

You can go stack management in kibana go to index patterns , this may differ based on diff kibana versions, i am using master

image
image4354×2176 442 KB

Press 'Create index pattern' , in next screen give it a name 'heartbeat-*'

image
image2752×1608 231 KB

then choose @timestamp as Time field

image
image2580×1240 158 KB

and you are done.

Go to Discover app, you should see the pattern and data.

1 Like
5

Hi @shahzad31,

The solution provided worked perfectly! :grinning:

Thank you very much!

6

I am glad it did.

Though @ManuelF I am curious why you use Discover app instead of uptime to view heartbeat data?

7

Actually I use Discover, mostly for:

1- Checking the data is arriving to Elasticsearch
2- Checking fields values and other details
3- To build filters and queries

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.