# Setup seems to be not configuring indexes correctly?

**URL:** https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602
**Category:** APM
**Created:** [January 9, 2019, 6:12pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602 "2019-01-09T18:12:53Z")
**Posts on this page:** 18
**Page:** 1

<div class="post-metadata">

### Author: ![krainboltgreene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krainboltgreene/32/37174_2.png) [@krainboltgreene](https://discuss.elastic.co/u/krainboltgreene)
#### Post date: [January 9, 2019, 6:12pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/1 "2019-01-09T18:12:53Z")

</div>

So I have logstash, elasticsearch, kibana, an apm server, an apm client, and an apm RUM client all running with the correct settings however when I click the "Setup Kibana" and attempt to view transaction details:

 ![45%20AM](https://us1.discourse-cdn.com/elastic/original/3X/6/9/69a91621bc8720c586aa425c349d44d300f8ad45.png)

First, it defaults to the default index which is _not_ the apm index. Feels strange since the system should know the right index.

Second, no results turn up:

 ![57%20AM](https://us1.discourse-cdn.com/elastic/original/3X/4/9/495f65ee43bd7a12ffd8e5c70307fcb40ca5ceaa.png)

Finally, when I expand the search window to 24hrs I get this error message:

 ![13%20AM](https://us1.discourse-cdn.com/elastic/original/3X/2/8/28ff99ee2072e0b56278e24ce4cad3b87cf8a49c.png)

I haven't done anything strange to my setup, I'm using the official docker images. Also, to be clear, I know _how to solve the individual issue_, but this feels like something I shouldn't have to drop into to fix since 5.X.Y worked just fine?

---

<div class="post-metadata">

### Author: ![sqren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sqren/32/26110_2.png) [@sqren](https://discuss.elastic.co/u/sqren)
#### Post date: [January 9, 2019, 8:44pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/2 "2019-01-09T20:44:45Z")

</div>

Hi Kurtis,

Sorry to hear about the bugs you are running into. What version of Kibana and APM Server are you using, and what steps do you take to resolve the error message that shows up when expanding the window in Discover?

---

<div class="post-metadata">

### Author: ![sqren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sqren/32/26110_2.png) [@sqren](https://discuss.elastic.co/u/sqren)
#### Post date: [January 10, 2019, 4:14pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/3 "2019-01-10T16:14:20Z")

</div>

Hi again,

After taking a closer look, I think you are missing the index template.

**Loading index template automatically**  
The index template should have been created automatically but you might have disabled this in the `apm-server.yml` config file.  
Read more about how the index template is automatically loaded: [https://www.elastic.co/guide/en/apm/server/current/configuration-template.html](https://www.elastic.co/guide/en/apm/server/current/configuration-template.html)

**Loading index template manually**  
To load the index template manually, please run:

```auto
apm-server setup --template

```

Read more about loading the index template manually here:  
[https://www.elastic.co/guide/en/apm/server/current/\_manually\_loading\_template\_configuration.html](https://www.elastic.co/guide/en/apm/server/current/_manually_loading_template_configuration.html)

---

<div class="post-metadata">

### Author: ![gil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gil/32/41911_2.png) [@gil](https://discuss.elastic.co/u/gil)
#### Post date: [January 10, 2019, 6:47pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/4 "2019-01-10T18:47:42Z")

</div>

In addition to what @sqren provided, you should find [https://www.elastic.co/blog/how-to-send-data-through-logstash-or-kafka-from-elastic-apm](https://www.elastic.co/blog/how-to-send-data-through-logstash-or-kafka-from-elastic-apm) useful for guidance on using apm-server with logstash.

---

<div class="post-metadata">

### Author: ![krainboltgreene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krainboltgreene/32/37174_2.png) [@krainboltgreene](https://discuss.elastic.co/u/krainboltgreene)
#### Post date: [January 22, 2019, 7:25pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/5 "2019-01-22T19:25:23Z")

</div>

I believe this has solved my issue, however I'm currently experiencing "1 of 7 shards failed" error, which I believe is something else. I appreciate the help here!

---

<div class="post-metadata">

### Author: ![krainboltgreene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krainboltgreene/32/37174_2.png) [@krainboltgreene](https://discuss.elastic.co/u/krainboltgreene)
#### Post date: [January 22, 2019, 10:01pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/6 "2019-01-22T22:01:00Z")

</div>

To get it truly to work I had to set these properties:

transaction.type  
context.service.agent.name  
context.service.name  
processor.event

To fielddata=true (see below), which isn't turned on by default. @gil @sqren, was there something I missed?

```auto
PUT apm-server-*/_mapping/doc
{
  "properties": {
    "processor.event": { 
      "type": "text",
      "fielddata": true
    }
  }
}

```

---

<div class="post-metadata">

### Author: ![gil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gil/32/41911_2.png) [@gil](https://discuss.elastic.co/u/gil)
#### Post date: [January 23, 2019, 3:18pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/7 "2019-01-23T15:18:48Z")

</div>

The apm index template should actually make those `keyword` fields, so something isn't lining up for your  
`apm-server setup --template` command (probably `setup.template.pattern`) or you need to recreate those indices after installing the index template, so the mapping is applied when the index is created.

---

<div class="post-metadata">

### Author: ![krainboltgreene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krainboltgreene/32/37174_2.png) [@krainboltgreene](https://discuss.elastic.co/u/krainboltgreene)
#### Post date: [January 23, 2019, 5:55pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/8 "2019-01-23T17:55:12Z")

</div>

Hum, I haven't changed the setup.template.pattern.

---

<div class="post-metadata">

### Author: ![gil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gil/32/41911_2.png) [@gil](https://discuss.elastic.co/u/gil)
#### Post date: [January 23, 2019, 7:06pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/9 "2019-01-23T19:06:13Z")

</div>

Excellent, then that's probably the issue here. The default index pattern is `apm-6.x.y-*` - it appears you've changed your indices to write to `apm-server-*`, which won't match the default and therefore not have that mapping applied when the index is created. Changing `setup.template.pattern='apm-server-6.x.y-*'` would address that, assuming you have retained the version number in your indices, which we highly recommend you do. If possible, I'd recommend switching to the default indices and index pattern as laid out in the docs and blog post referenced previously.

---

<div class="post-metadata">

### Author: ![krainboltgreene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krainboltgreene/32/37174_2.png) [@krainboltgreene](https://discuss.elastic.co/u/krainboltgreene)
#### Post date: [January 25, 2019, 12:22am UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/10 "2019-01-25T00:22:43Z")

</div>

Oh wow, okay, that makes sense.

---

<div class="post-metadata">

### Author: ![krainboltgreene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krainboltgreene/32/37174_2.png) [@krainboltgreene](https://discuss.elastic.co/u/krainboltgreene)
#### Post date: [January 29, 2019, 12:39am UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/11 "2019-01-29T00:39:56Z")

</div>

Okay, I've searched my instance top to bottom and I can find nowhere that I've defined it as `apm-server-`. Here's my logstash:

```auto
input {
  udp {
    port => 12200
    codec => json_lines
    add_field => {
      "input" => "udp"
    }
  }

  gelf {
    add_field => {
      "input" => "gelf"
    }
  }

  http {
    add_field => {
      "input" => "http"
    }
  }

  beats {
    port => 5044
  }
}

output {
  if [@metadata][beat] {
    elasticsearch {
      hosts => ["http://elasticsearch:9200"]
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    }
  } else if [input] == "gelf" {
    elasticsearch {
      hosts => ["http://elasticsearch:9200"]
      index => "docker-%{+YYYY.MM.dd}"
    }
  } else {
    elasticsearch {
      hosts => ["http://elasticsearch:9200"]
      index => "default-%{+YYYY.MM.dd}"
    }
  }

  if !([input] == "beats") {
    stdout {
      codec => json_lines
    }
  }
}

```

I just did a fresh install and it's still creating an index at `apm-server-*`.

---

<div class="post-metadata">

### Author: ![krainboltgreene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krainboltgreene/32/37174_2.png) [@krainboltgreene](https://discuss.elastic.co/u/krainboltgreene)
#### Post date: [January 29, 2019, 1:02am UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/12 "2019-01-29T01:02:56Z")

</div>

I also set the configuration you recommended and I'm still having to set fielddata. Here's my ENTIRE configuration: [https://gist.github.com/krainboltgreene/cd7afac60a84c92e2eeaee0ba588a11d](https://gist.github.com/krainboltgreene/cd7afac60a84c92e2eeaee0ba588a11d)

---

<div class="post-metadata">

### Author: ![gil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gil/32/41911_2.png) [@gil](https://discuss.elastic.co/u/gil)
#### Post date: [January 29, 2019, 8:27pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/13 "2019-01-29T20:27:07Z")

</div>

Sorry for the trouble @krainboltgreene. apm-server is coming from `[@metadata][beat]` - this [issue](https://github.com/elastic/apm-server/issues/1792) tracks the source of that confusion. You can add a condition in the logstash (`[@metadata][beat] == apm-server`) and set the index to `apm-%{[@metadata][version]}-%{+YYYY.MM.dd}` accordingly.

---

<div class="post-metadata">

### Author: ![krainboltgreene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krainboltgreene/32/37174_2.png) [@krainboltgreene](https://discuss.elastic.co/u/krainboltgreene)
#### Post date: [January 29, 2019, 8:28pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/14 "2019-01-29T20:28:40Z")

</div>

No problems at all @gil, this is amazing software and you all work very hard and I appreciate that!

---

<div class="post-metadata">

### Author: ![krainboltgreene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krainboltgreene/32/37174_2.png) [@krainboltgreene](https://discuss.elastic.co/u/krainboltgreene)
#### Post date: [January 31, 2019, 6:42pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/15 "2019-01-31T18:42:04Z")

</div>

Okay, so I've now modified my logstash configuration so that it creates the index as per the pattern above. I've renamed old indexes as well and I've rebuilt my index and dashboards. Interestingly when I look at the individual transaction in the discover panel (`processor.event:"transaction" AND transaction.id:"aa916d668cd6ae8f" AND trace.id:"6baffb6dada15e95e08b5051279c0afc"`) I get this warning:

 ![47%20AM](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a5fcf01feb6354bd4c81002a9cb0966109291975.png)

Does anyone know what this could mean or how to investigate it?

---

<div class="post-metadata">

### Author: ![krainboltgreene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krainboltgreene/32/37174_2.png) [@krainboltgreene](https://discuss.elastic.co/u/krainboltgreene)
#### Post date: [February 20, 2019, 6:34pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/16 "2019-02-20T18:34:42Z")

</div>

After completely rebuilding everything from scratch it's working perfectly. Thanks so much @gil!!!!!

---

<div class="post-metadata">

### Author: ![gil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gil/32/41911_2.png) [@gil](https://discuss.elastic.co/u/gil)
#### Post date: [February 20, 2019, 7:26pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/17 "2019-02-20T19:26:35Z")

</div>

@krainboltgreene I missed your last post - I've seen that issue when a document in the APM index doesn't have a scripted field that is expected. Please let us know if you come across it again and we can try to track that down.

I'm really glad to hear things are working now!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 13, 2019, 3:38pm UTC](https://discuss.elastic.co/t/setup-seems-to-be-not-configuring-indexes-correctly/163602/18 "2019-03-13T15:38:22Z")

</div>

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.
