Multiple hosts monitoring


(leclerc cyril) #1

Hi i have 2 hosts with topbeat configured to send to another host (third)
the problem is i can't disting 2 hosts on kibana dashboard, furthermore it takes all "-" in name as a new machine so i have 2 hosts to monitor, but i have 5 lines on dashboard =

name

test-int-name-01
test-int-name-02

i see

test
int
name
01
02

it is a big issue how i can do ?

thanks !


(Andrew Kroh) #2

This is caused by not loading the provided index template. Please see the documentation on how to load the index template. You will have to delete the data you already indexed in order to correct the issue (there's a note about that in the docs).


(leclerc cyril) #3

thank you very much you're right i will try it with the windows command there is no CURL in windows


(leclerc cyril) #4

I am sorry but i did the command via postman but it doesn't work, i use topbeat on only one computer, i delete the old data but i still see like it was several hosts monitored, see the pictures

as you can see i monitor only one host , its name is "rs-tst-aof-01", indeed i can't use monitoring due to duplicate data


(Mark Gavalda) #5

The problem is Beats splits the hostnames into multiple ones at the dashes. I came to the forum to report the exact same thing :-/ I even set the:
shipper:
name: "my-shipper"
configuration option, but it results in the same.


(Andrew Kroh) #6

Please provide the output of the following Elasticsearch queries. You'll probably need to use something like http://pastebin.com in order to share the results due to post size limits.

http://<elasticsearch>:9200/_template/topbeat?pretty

http://<elasticsearch>:9200/topbeat-2016.08.07/_mapping?pretty <- substitute in today's date


(leclerc cyril) #8

this is the mapping in attchment, thanks

{
"topbeat-2016.08.09": {
"mappings": {
"filesystem": {
"properties": {
"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"beat": {
"properties": {
"hostname": {
"type": "string"
},
"name": {
"type": "string"
}
}
},
"count": {
"type": "long"
},
"fs": {
"properties": {
"avail": {
"type": "long"
},
"device_name": {
"type": "string"
},
"files": {
"type": "long"
},
"free": {
"type": "long"
},
"free_files": {
"type": "long"
},
"mount_point": {
"type": "string"
},
"total": {
"type": "long"
},
"used": {
"type": "long"
},
"used_p": {
"type": "double"
}
}
},
"type": {
"type": "string"
}
}
},
"system": {
"properties": {
"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"beat": {
"properties": {
"hostname": {
"type": "string"
},
"name": {
"type": "string"
}
}
},
"count": {
"type": "long"
},
"cpu": {
"properties": {
"idle": {
"type": "long"
},
"iowait": {
"type": "long"
},
"irq": {
"type": "long"
},
"nice": {
"type": "long"
},
"softirq": {
"type": "long"
},
"steal": {
"type": "long"
},
"system": {
"type": "long"
},
"system_p": {
"type": "double"
},
"user": {
"type": "long"
},
"user_p": {
"type": "double"
}
}
},
"load": {
"properties": {
"load1": {
"type": "long"
},
"load15": {
"type": "long"
},
"load5": {
"type": "long"
}
}
},
"mem": {
"properties": {
"actual_free": {
"type": "long"
},
"actual_used": {
"type": "long"
},
"actual_used_p": {
"type": "double"
},
"free": {
"type": "long"
},
"total": {
"type": "long"
},
"used": {
"type": "long"
},
"used_p": {
"type": "double"
}
}
},


(leclerc cyril) #9
      "swap": {
        "properties": {
          "free": {
            "type": "long"
          },
          "total": {
            "type": "long"
          },
          "used": {
            "type": "long"
          },
          "used_p": {
            "type": "long"
          }
        }
      },
      "type": {
        "type": "string"
      }
    }
  },
  "process": {
    "properties": {
      "@timestamp": {
        "type": "date",
        "format": "strict_date_optional_time||epoch_millis"
      },
      "beat": {
        "properties": {
          "hostname": {
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        }
      },
      "count": {
        "type": "long"
      },
      "proc": {
        "properties": {
          "cmdline": {
            "type": "string"
          },
          "cpu": {
            "properties": {
              "start_time": {
                "type": "string"
              },
              "system": {
                "type": "long"
              },
              "total": {
                "type": "long"
              },
              "user": {
                "type": "long"
              },
              "user_p": {
                "type": "double"
              }
            }
          },
          "mem": {
            "properties": {
              "rss": {
                "type": "long"
              },
              "rss_p": {
                "type": "long"
              },
              "share": {
                "type": "long"
              },
              "size": {
                "type": "long"
              }
            }
          },
          "name": {
            "type": "string"
          },
          "pid": {
            "type": "long"
          },
          "ppid": {
            "type": "long"
          },
          "state": {
            "type": "string"
          },
          "username": {
            "type": "string"
          }
        }
      },
      "type": {
        "type": "string"
      }
    }
  }
}

}
}


(Andrew Kroh) #10

@fdlprod, the mapping that you posted indicates that you do not have the provided index template installed.

  1. Stop the Topbeat service.

PS C:\Program Files\Topbeat> Stop-Service topbeat

  1. Install the template:

PS C:\Program Files\Topbeat> Invoke-WebRequest -Method Put -InFile topbeat.template.json -Uri http://localhost:9200/_template/topbeat?pretty

  1. Delete the existing Topbeat data that has the wrong mappings.

PS C:\Program Files\Topbeat> Invoke-WebRequest -Method Delete -Uri "http://localhost:9200/topbeat-*"

  1. Restart the Topbeat service:

PS C:\Program Files\Topbeat> Start-Service topbeat


(leclerc cyril) #11

i am sorry bu t always same result i try also in filebeat.yml to set template and override : true same error strange because in discover it seems to be OK


(system) #12

This topic was automatically closed after 21 days. New replies are no longer allowed.