Needed to offset the timeseries for Metricbeat dashboard visualizartions to work


I just need some help to try to understand why exactly my workaround worked/as necessary.

We've setup some metricbeats agents and Inoticed that every visualization of the TSVB type was not working: gauges, tables, ... They were all zeroed and I couldn't find out why.

So, I've find a solution by setting for every visualization the "Offset series time by (1m, 1h, 1w, 1d)" to 15m... Now they are all showing data, but I guess they are out of sync with the remaining visualizations in the dashboard.

So, my questions are:

  1. Can you help me understand why this workaround "solved" the issue?
  2. Why was it necessary to fix the defaults Metricbeat visualizations? That feels so wrong to me, that's why I'm very suspicious of my workaround
  3. Does it have anything to do with the period set in the modules.d/system.yml?
- module: system
  period: 10s
    - cpu
    - load
    - memory
    - network
    - process
    - process_summary
    - socket_summary
    by_cpu: 5      # include top 5 processes by CPU
    by_memory: 5   # include top 5 processes by memory

- module: system
  period: 1m
    - filesystem
    - fsstat
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)'

- module: system
  period: 15m
    - uptime

Any help would be much appreciated!

Most likely the time is not correct / synced / same on all the servers that or you have some huge delay (which you shouldn't)

when you look at discover do you see the documents coming in in real time.

Check the timestamps.

Remember the timestamps in elastic are always stored as UTC but Kibana will display them in your local timezone.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.