No metricbeat data sent via Logstash is shown in Kibana "Metrics" section

phlegx · November 30, 2020, 3:24pm

Hi there,

I'm sending Metricbeat data via Logstash to Elasticsearch. Data is there and I can query the index just fine in Kibana "Discover".

However, even if I add the index in "Observability -> Metrics - > Settings", I cannot see any data in "Observabilty -> Metrics".

Maybe there is something missing in the index template. How can I debug this and create a proper index template via API?

thanks!

simianhacker · November 30, 2020, 4:29pm

Can you post the mapping for one of the indices? You can run the command below in the "Dev Console" but replace {index-name} with one of the index names.

GET {index-name}/_mapping

phlegx · November 30, 2020, 5:06pm

Hi Chris! Yes I can. Here is the output:

gist.github.com

https://gist.github.com/phlegx/e58b000ff9becff279af1033eea98a8c

gistfile1.txt

curl -u elastic:xxxx localhost:9200/jt-metricbeat-staging-000003/_mapping | jq

{
  "jt-metricbeat-staging-000003": {
    "mappings": {
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "@version": {

This file has been truncated. show original

The output is a bit long. So I had to put it on a gist.

thanks!

simianhacker · November 30, 2020, 7:23pm

Looks like your Metricbeat mappings are not setup correctly. This is usually done by running ./metricbeat setup directly against your Elasticsearch cluster. Since you have a custom index pattern you might need to fiddle with the metricbeat.yml some to ensure the index pattern gets setup correctly. OR you could just run the default, then look at what the index template for metricbeat looks like and copy/modify it for your index patterns.

system · December 28, 2020, 7:23pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.