Monitoring data not showing up in kibana

(Tanya Shah) #21

Hi @chrisronline this is the output
{
"took" : 15,
"timed_out" : false,
"_shards" : {
"total" : 15,
"successful" : 15,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 10000,
"relation" : "gte"
},
"max_score" : null,
"hits" :
},
"aggregations" : {
"types" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" :
}
}
}

(Tanya Shah) #22

Hi @chrisronline
Can you please look at the output of the query you asked me to execute?

(Chris Roberson) #23

Hi @Tanya_Shah,

I just want to verify something.

When I run the above query, I see:

{
  "took" : 5,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 71,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "types" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "index_stats",
          "doc_count" : 34
        },

The buckets array is filled out. Can you confirm that the buckets array, for you, is empty? It appears that way but I just want to verify there isn't some formatting issue.

(Tanya Shah) #24

Hi @chrisronline
the bucket array for me is empty only.

(Chris Roberson) #25

Can we retry this command and can you use https://gist.github.com/ to send the entire response? I think you did it earlier but it wasn't the complete response

(Tanya Shah) #26

@chrisronline
I posted the response at https://gist.github.com/26tanyashah/c26bc69971d395307871d8b6157918ab

Please see if that helps

(Chris Roberson) #27

Thanks.

The problem seems to be that the mappings are disabled for the index:

{
  ".monitoring-es-7-2019.05.20" : {
    "mappings" : {
      "dynamic" : "false",
      "enabled" : false,

Let's see if we can figure out why that is.

First thing, let's see the index template used when creating monitoring indices by running the following command and reply with the response:

GET _template/.monitoring-es
(Tanya Shah) #28

@chrisronline
i have posted the response here at https://gist.github.com/26tanyashah/62facb2215886b97dc7a3daccc4b0e62

(Chris Roberson) #29

It appears that index template is fine.

The most likely scenario here is there is another index template that is casting an extremely wide net that has mappings disabled.

We don't have a great way to searching for this, so the response will be quite large, but can you also run and return the result of:

GET _template
``
(Tanya Shah) #30

@chrisronline Posted the result at this link

(Chris Roberson) #31
"template_1" : {
    "order" : 0,
    "index_patterns" : [
      "*"
    ],
    "settings" : {
      "index" : {
        "number_of_shards" : "1"
      }
    },
    "mappings" : {
      "enabled" : false
    },
    "aliases" : { }
  },

That index template is causing this. It is disabling mappings for all your indices. I don't think this is what you intended. I'd recommend either just removing this index template, or changing it to apply to a more restrictive list of indices.

(Tanya Shah) #32

@chrisronline
OK,thanks a lot for the support.I am trying this approach and then will post back the results here.

(Tanya Shah) #33

@chrisronline The issue got resolved.It was because of the mapping issue only.Now all the data is visible in kibana.

(Chris Roberson) #34

Great to hear!

1 Like