Multiple hosts monitoring

Elastic Stack Beats
1

Hi i have 2 hosts with topbeat configured to send to another host (third)
the problem is i can't disting 2 hosts on kibana dashboard, furthermore it takes all "-" in name as a new machine so i have 2 hosts to monitor, but i have 5 lines on dashboard =

name

test-int-name-01
test-int-name-02

i see

test
int
name
01
02

it is a big issue how i can do ?

thanks !

2

This is caused by not loading the provided index template. Please see the documentation on how to load the index template. You will have to delete the data you already indexed in order to correct the issue (there's a note about that in the docs).

3

thank you very much you're right i will try it with the windows command there is no CURL in windows

4

I am sorry but i did the command via postman but it doesn't work, i use topbeat on only one computer, i delete the old data but i still see like it was several hosts monitored, see the pictures

topbeat.png2481×781 81.8 KB

as you can see i monitor only one host , its name is "rs-tst-aof-01", indeed i can't use monitoring due to duplicate data

top beat 2.png2062×720 62.5 KB

5

The problem is Beats splits the hostnames into multiple ones at the dashes. I came to the forum to report the exact same thing :-/ I even set the:
shipper:
name: "my-shipper"
configuration option, but it results in the same.

6

Please provide the output of the following Elasticsearch queries. You'll probably need to use something like http://pastebin.com in order to share the results due to post size limits.

http://<elasticsearch>:9200/_template/topbeat?pretty

http://<elasticsearch>:9200/topbeat-2016.08.07/_mapping?pretty <- substitute in today's date

8

this is the mapping in attchment, thanks

{
"topbeat-2016.08.09": {
"mappings": {
"filesystem": {
"properties": {
"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"beat": {
"properties": {
"hostname": {
"type": "string"
},
"name": {
"type": "string"
}
}
},
"count": {
"type": "long"
},
"fs": {
"properties": {
"avail": {
"type": "long"
},
"device_name": {
"type": "string"
},
"files": {
"type": "long"
},
"free": {
"type": "long"
},
"free_files": {
"type": "long"
},
"mount_point": {
"type": "string"
},
"total": {
"type": "long"
},
"used": {
"type": "long"
},
"used_p": {
"type": "double"
}
}
},
"type": {
"type": "string"
}
}
},
"system": {
"properties": {
"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"beat": {
"properties": {
"hostname": {
"type": "string"
},
"name": {
"type": "string"
}
}
},
"count": {
"type": "long"
},
"cpu": {
"properties": {
"idle": {
"type": "long"
},
"iowait": {
"type": "long"
},
"irq": {
"type": "long"
},
"nice": {
"type": "long"
},
"softirq": {
"type": "long"
},
"steal": {
"type": "long"
},
"system": {
"type": "long"
},
"system_p": {
"type": "double"
},
"user": {
"type": "long"
},
"user_p": {
"type": "double"
}
}
},
"load": {
"properties": {
"load1": {
"type": "long"
},
"load15": {
"type": "long"
},
"load5": {
"type": "long"
}
}
},
"mem": {
"properties": {
"actual_free": {
"type": "long"
},
"actual_used": {
"type": "long"
},
"actual_used_p": {
"type": "double"
},
"free": {
"type": "long"
},
"total": {
"type": "long"
},
"used": {
"type": "long"
},
"used_p": {
"type": "double"
}
}
},

9 
      "swap": {
        "properties": {
          "free": {
            "type": "long"
          },
          "total": {
            "type": "long"
          },
          "used": {
            "type": "long"
          },
          "used_p": {
            "type": "long"
          }
        }
      },
      "type": {
        "type": "string"
      }
    }
  },
  "process": {
    "properties": {
      "@timestamp": {
        "type": "date",
        "format": "strict_date_optional_time||epoch_millis"
      },
      "beat": {
        "properties": {
          "hostname": {
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        }
      },
      "count": {
        "type": "long"
      },
      "proc": {
        "properties": {
          "cmdline": {
            "type": "string"
          },
          "cpu": {
            "properties": {
              "start_time": {
                "type": "string"
              },
              "system": {
                "type": "long"
              },
              "total": {
                "type": "long"
              },
              "user": {
                "type": "long"
              },
              "user_p": {
                "type": "double"
              }
            }
          },
          "mem": {
            "properties": {
              "rss": {
                "type": "long"
              },
              "rss_p": {
                "type": "long"
              },
              "share": {
                "type": "long"
              },
              "size": {
                "type": "long"
              }
            }
          },
          "name": {
            "type": "string"
          },
          "pid": {
            "type": "long"
          },
          "ppid": {
            "type": "long"
          },
          "state": {
            "type": "string"
          },
          "username": {
            "type": "string"
          }
        }
      },
      "type": {
        "type": "string"
      }
    }
  }
}

}
}

10

@fdlprod, the mapping that you posted indicates that you do not have the provided index template installed.

  1. Stop the Topbeat service.

PS C:\Program Files\Topbeat> Stop-Service topbeat

  1. Install the template:

PS C:\Program Files\Topbeat> Invoke-WebRequest -Method Put -InFile topbeat.template.json -Uri http://localhost:9200/_template/topbeat?pretty

  1. Delete the existing Topbeat data that has the wrong mappings.

PS C:\Program Files\Topbeat> Invoke-WebRequest -Method Delete -Uri "http://localhost:9200/topbeat-*"

  1. Restart the Topbeat service:

PS C:\Program Files\Topbeat> Start-Service topbeat

11

i am sorry bu t always same result i try also in filebeat.yml to set template and override : true same error strange because in discover it seems to be OK

12

This topic was automatically closed after 21 days. New replies are no longer allowed.