No xpack monitoring for metricbeat

Elastic Stack Beats
1

I have enabled xpack monitoring in 6.3.0 in filebeat, auditbeat, and metricbeat. Security is disabled. filebeat and auditbeat show up just fine, metricbeat does not. metricbeat logs an error every 10 seconds

2018-06-19T17:04:12.958-0400    ERROR   pipeline/output.go:92   Failed to publish events: 500 Internal Server Error: {"took":6,"ignored":false,"errors":true,"error":{"type":"export_exception","reason":"Exception when closing export bulk","caused_by":{"type":"export_exception","reason":"failed to flush export bulks","caused_by":{"type":"export_exception","reason":"bulk [default_local] reports failures when exporting documents","exceptions":[{"type":"export_exception","reason":"MapperParsingException[object mapping for [beats_stats.metrics.beat.cpu.user.time] tried to parse field [time] as object, but found a concrete value]","caused_by":{"type":"mapper_parsing_exception","reason":"object mapping for [beats_stats.metrics.beat.cpu.user.time] tried to parse field [time] as object, but found a concrete value"}}]}}}}

Am I missing an index template or something?

2

Are you are using version v6.3.0 all around (Metricbeat + Elasticsearch + Kibana)?

The v6.3.0 Beat's produce beats_stats.metrics.beat.cpu.user.time.ms. source ref

And the Elasticsearch v6.3.0 index template for Beat monitoring expects time to be an object with one field called ms.

3

I would have sworn to this, but when I checked the elasticsearch logs to see how the bulk insert was failing I saw this.

"beat":{"type":"metricbeat","version":"6.2.4"

As soon as I updated the metricbeat to 6.3.0 it started reporting in correctly.

The .monitoring-beats-6-%{yyyy.MM.dd} index only has the major version in the name. Does that mean we cannot mix and match beats in the environment?

4

You need to keep them on the same version for now. Hopefully as Beats monitoring becomes more stable there will be fewer changes and we can have broader compatibility. This version compat data is listed on the support matrix.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.