Needed to offset the timeseries for Metricbeat dashboard visualizartions to work

[ffknob (Flávio Knob)]

Hi

I just need some help to try to understand why exactly my workaround worked/as necessary.

We've setup some metricbeats agents and Inoticed that every visualization of the TSVB type was not working: gauges, tables, ... They were all zeroed and I couldn't find out why.

So, I've find a solution by setting for every visualization the "Offset series time by (1m, 1h, 1w, 1d)" to 15m... Now they are all showing data, but I guess they are out of sync with the remaining visualizations in the dashboard.

So, my questions are:

1. Can you help me understand why this workaround "solved" the issue?
2. Why was it necessary to fix the defaults Metricbeat visualizations? That feels so wrong to me, that's why I'm very suspicious of my workaround
3. Does it have anything to do with the period set in the modules.d/system.yml?

- module: system
  period: 10s
  metricsets:
    - cpu
    - load
    - memory
    - network
    - process
    - process_summary
    - socket_summary
  process.include_top_n:
    by_cpu: 5      # include top 5 processes by CPU
    by_memory: 5   # include top 5 processes by memory

- module: system
  period: 1m
  metricsets:
    - filesystem
    - fsstat
  processors:
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)'

- module: system
  period: 15m
  metricsets:
    - uptime

Any help would be much appreciated!

[stephenb (Stephen Brown)]

Most likely the time is not correct / synced / same on all the servers that or you have some huge delay (which you shouldn't)

when you look at discover do you see the documents coming in in real time.

Check the timestamps.

Remember the timestamps in elastic are always stored as UTC but Kibana will display them in your local timezone.