# Service States: No results found

**URL:** <https://discuss.elastic.co/t/service-states-no-results-found/240021>\
**Category:** Metrics\
**Created:** [July 6, 2020, 2:12pm UTC](https://discuss.elastic.co/t/service-states-no-results-found/240021 "2020-07-06T14:12:30Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kawther](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kawther/32/72397_2.png) [@Kawther](https://discuss.elastic.co/u/Kawther)\
**Post date:** [July 6, 2020, 2:12pm UTC](https://discuss.elastic.co/t/service-states-no-results-found/240021/1 "2020-07-06T14:12:30Z")

</div>

Hello,

I am working with metricbeat 7.7.0 , I enabled system module to monitor service status

- module: system  
period: 10s  
metricsets:
  - cpu
  - load
  - memory
  - network
  - process
  - process\_summary
  - socket\_summary
  - entropy
  - core
  - diskio
  - socket
  - service  
#- users  
process.include\_top\_n:  
by\_cpu: 5 # include top 5 processes by CPU  
by\_memory: 5 # include top 5 processes by memory

But I didn't see anything "No results found"

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/2/3223a331c68e255f84c8a3b029de04e6ccbe0379.png)

Are there any modifications to make ?  
Could you please help ?

---

<div class="post-metadata">

**Author:** ![afgomez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/afgomez/32/59274_2.png) [@afgomez](https://discuss.elastic.co/u/afgomez)\
**Post date:** [July 14, 2020, 9:35am UTC](https://discuss.elastic.co/t/service-states-no-results-found/240021/2 "2020-07-14T09:35:41Z")

</div>

Hi @Kawther,

Let's try to find the source of this. Do you have any other metricbeat modules enabled? Do they work?

If this is the only module, do the value for the following fields on your `metricbeat.yml` look correct for your cluster?

```auto
output.elasticsearch:
  hosts: [....]
  username: "..."
  password: "..."

```

---

<div class="post-metadata">

**Author:** ![Kawther](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kawther/32/72397_2.png) [@Kawther](https://discuss.elastic.co/u/Kawther)\
**Post date:** [July 18, 2020, 2:06pm UTC](https://discuss.elastic.co/t/service-states-no-results-found/240021/3 "2020-07-18T14:06:44Z")

</div>

Hello @afgomez, thank you for your response

Yes I have mongodb module enabled, and I have dashboard and data displayed correctly

My config:  
output.elasticsearch:  
#Array of hosts to connect to.  
hosts: ["10.228.xx.xx:9200"]  
#protocol: "https"  
#Authentication credentials - either API key or username/password.  
#api\_key: "id:api\_key"  
#username: "elastic"

---

<div class="post-metadata">

**Author:** ![Kawther](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kawther/32/72397_2.png) [@Kawther](https://discuss.elastic.co/u/Kawther)\
**Post date:** [July 20, 2020, 10:25am UTC](https://discuss.elastic.co/t/service-states-no-results-found/240021/4 "2020-07-20T10:25:05Z")

</div>

I still have the issue, could you please help ?

---

<div class="post-metadata">

**Author:** ![Kerry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kerry/32/40330_2.png) [@Kerry](https://discuss.elastic.co/u/Kerry)\
**Post date:** [July 20, 2020, 3:28pm UTC](https://discuss.elastic.co/t/service-states-no-results-found/240021/5 "2020-07-20T15:28:55Z")

</div>

Hi @Kawther,

Could you confirm for me that [systemd resource accounting is enabled](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-service.html#_systemd_resource_accounting_and_process_metrics)? The `system.service` metricset will only work with that enabled. With a lot of distributions `tasks` and `memory` are the only things with resource accounting enabled by default.

If that's enabled and configured correctly, could you please paste an example of one of your `system.service` Metricbeat documents? (Please amend anything confidential).

You should be able to use a query similar to the following in Kibana's Dev Tools:

```
  GET metricbeat-*/_search
      {
          "query": {
              "term": {"event.dataset": "system.service"}
          }
  }
```

---

<div class="post-metadata">

**Author:** ![Kawther](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kawther/32/72397_2.png) [@Kawther](https://discuss.elastic.co/u/Kawther)\
**Post date:** [July 20, 2020, 4:35pm UTC](https://discuss.elastic.co/t/service-states-no-results-found/240021/6 "2020-07-20T16:35:02Z")

</div>

Hello @Kerry, thank you for your response.

Please how can I check if the systemd resource accounting is enabed ?

This is the result of GET :  
{  
"took" : 2,  
"timed\_out" : false,  
"\_shards" : {  
"total" : 3,  
"successful" : 3,  
"skipped" : 0,  
"failed" : 0  
},  
"hits" : {  
"total" : {  
"value" : 0,  
"relation" : "eq"  
},  
"max\_score" : null,  
"hits" : []  
}  
}

Thank you

---

<div class="post-metadata">

**Author:** ![Kerry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kerry/32/40330_2.png) [@Kerry](https://discuss.elastic.co/u/Kerry)\
**Post date:** [July 21, 2020, 9:45am UTC](https://discuss.elastic.co/t/service-states-no-results-found/240021/7 "2020-07-21T09:45:12Z")

</div>

@Kawther Okay - there's no matching documents in your cluster at all, so the empty dashboard is to be expected. This looks like a configuration issue.

> Please how can I check if the systemd resource accounting is enabed ?

This varies between Linux distributions, and on how systemd has been setup (this isn't something Elastic controls). The systemd resource control documentation exists [here](https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html), the options of interest have the suffix `Accounting`, e.g. `CPUAccounting=`. With one, or multiple, of these accounting features enabled the Metricbeat metricset _should_ work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2020, 9:45am UTC](https://discuss.elastic.co/t/service-states-no-results-found/240021/8 "2020-08-18T09:45:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
