Monitoring data not showing up in kibana

Elastic Stack Kibana
21

Hi @chrisronline this is the output
{
"took" : 15,
"timed_out" : false,
"_shards" : {
"total" : 15,
"successful" : 15,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 10000,
"relation" : "gte"
},
"max_score" : null,
"hits" :
},
"aggregations" : {
"types" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" :
}
}
}

22

Hi @chrisronline
Can you please look at the output of the query you asked me to execute?

23

Hi @Tanya_Shah,

I just want to verify something.

When I run the above query, I see:

{
  "took" : 5,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 71,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "types" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "index_stats",
          "doc_count" : 34
        },

The buckets array is filled out. Can you confirm that the buckets array, for you, is empty? It appears that way but I just want to verify there isn't some formatting issue.

24

Hi @chrisronline
the bucket array for me is empty only.

25

Can we retry this command and can you use https://gist.github.com/ to send the entire response? I think you did it earlier but it wasn't the complete response

26

@chrisronline
I posted the response at https://gist.github.com/26tanyashah/c26bc69971d395307871d8b6157918ab

Please see if that helps

27

Thanks.

The problem seems to be that the mappings are disabled for the index:

{
  ".monitoring-es-7-2019.05.20" : {
    "mappings" : {
      "dynamic" : "false",
      "enabled" : false,

Let's see if we can figure out why that is.

First thing, let's see the index template used when creating monitoring indices by running the following command and reply with the response:

GET _template/.monitoring-es
28

@chrisronline
i have posted the response here at Response for GET _template/.monitoring-es · GitHub

29

It appears that index template is fine.

The most likely scenario here is there is another index template that is casting an extremely wide net that has mappings disabled.

We don't have a great way to searching for this, so the response will be quite large, but can you also run and return the result of:

GET _template
``
30

@chrisronline Posted the result at this link

31 
"template_1" : {
    "order" : 0,
    "index_patterns" : [
      "*"
    ],
    "settings" : {
      "index" : {
        "number_of_shards" : "1"
      }
    },
    "mappings" : {
      "enabled" : false
    },
    "aliases" : { }
  },

That index template is causing this. It is disabling mappings for all your indices. I don't think this is what you intended. I'd recommend either just removing this index template, or changing it to apply to a more restrictive list of indices.

32

@chrisronline
OK,thanks a lot for the support.I am trying this approach and then will post back the results here.

33

@chrisronline The issue got resolved.It was because of the mapping issue only.Now all the data is visible in kibana.

34

Great to hear!

1 Like
35

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.