[SOLVED] Visualization shortens beats.name

Elastic Stack Beats
1

I've loaded the example beats dashboards/searches/visualizations into Kibana. They are definitely working. Except that a lot of beat.name data is truncated/abbreviated.

This is only the Topbeat dashboard/etc. since I only have it and Filebeat running.

As in, pre-prod-example-01.example.tld becomes just example or pre or 01.

I see this in the legends of the System Load and Process Status visualizations. It also occurs in the beats.name column of the Servers visualization.

Is there a way to prevent that form happening? 01 is hardly useful when you multiple servers ending in -01. I'd rather have it wrap or something than what it is doing.

Thanks!

2

Have you loaded applied the indexes to elasticsearch before installing the dashboards and before indexing data via beats?

3

I'm not entirely sure what you mean. I was indexing data from filebeat and topbeat before I installed the example dashboards.

I checked out the dashboard project, modified it to use my index name instead of topbeat, and then ran the load.sh script.

What does "applied the indexes" mean? I thought an index was similar to a database in sql.

4

sorry, typo. I meant to write: have you applied the index templates as described in getting started guide before indexing any data?

5

I may have made a bad assumption. Topbeat is sending to Logstash, so I assumed Logstash would deal with the template aspect. Plus, since I'm not using an index of "topbeat", I didn't think those templates would apply.

I have read the elasticsearch docs on templates, but maybe I missed something...

6

Having a template is not mandatory in elasticsearch/logstash. If data is processed by logstash, you have to take care of the mappings in the generated index. Problem is the strings (which is default) are analyzed if not disabled by mapping. Templates can be used to specify a mapping to be used with newly created indexes.

1 Like
7

Ah, so I need to take the topbeat template, and the logstash template, and merge them together.

Thanks for the help!

8

And, after the index rolled over to the next day, it appears it is working the way I wanted. Thanks again!

For reference, this is the template I'm using on my 2.2.0 logstash indexer:

9

Glad to hear it worked. The template cannot be changed on existing indices but will be applied to new ones. That explains why it worked on the next day.

10

Yep, the docs are pretty clear on that.

Does discourse have a "mark solved" button, or should I just edit the title of my initial post?

11

I don't think so. There is a close option but I don't think that is what we want to do in case someone wants to comment in the future. Editing title is definitively an option.