Greetings!
We are performing rollups on metricbeat data that occur periodically so that I can perform analysis on counted data rather than gigabytes of raw data. Right now we are testing with three servers which each have a specific server ID (something like '5ac29e1b13813399132166af') that we are going to use to track all of the data.
When I look at the rollup in Kibana there are records that contain one of these 3 ID's - which is what I expect - but there are several that contain no server ID. I think these are records that contain amalgamations of all three servers. I.e., These "no ID records" are just summations of all of the binning, etc. that the rollup performed. They just contain counts and stuff related to what exactly the rollup did. Is that correct?
These no ID records look like this the JSON below. They all contain "fields.server.id.terms.value": "None"
{
"@timestamp.date_histogram.time_zone": "UTC",
"@timestamp.date_histogram.timestamp": 1563910440000,
"system.cpu.total.pct.avg._count": 1,
"system.cpu.total.pct.histogram.interval": 5,
"system.cpu.total.pct.terms._count": 1,
"system.cpu.cores.terms.value": 2,
"@timestamp.date_histogram.interval": "1m",
"@timestamp.date_histogram._count": 1,
"system.cpu.total.pct.avg.value": 0.108,
"system.cpu.total.pct.terms.value": 0.108,
"system.cpu.total.pct.value_count.value": 1,
"system.cpu.total.pct.histogram.value": 0,
"system.cpu.total.pct.max.value": 0.108,
"system.cpu.total.pct.sum.value": 0.108,
"_rollup.version": 2,
"fields.server.id.terms.value": "None",
"fields.oss.id.terms._count": 1,
"system.cpu.total.pct.histogram._count": 1,
"system.cpu.cores.terms._count": 1,
"system.cpu.total.pct.min.value": 0.108,
"_rollup.id": "cpu_minute_v6_rollup"
}
Thank you!