Tags written to .monitoring-es-8-mb by metricbeat is not searchable

Elastic Stack Beats
,
1

The tags added through processors in metricbeat.yml writes to monitoring-es-8-mb index which shows tags field when searched with only index name.
Metricbeat.yml config

processors:
  - add_tags:
      tags: [Earth]
      target: "tags"

GET .monitoring-es-8-mb/_search

gives

{
        "_index": ".ds-.monitoring-es-8-mb-2023.02.02-000001",
        "_id": "Q7mdohkVSO-ZPvOI2Wv3Vg:vCvc1I0mR0exEf8pCdH8Gw:.ds-ilm-history-5-2022.07.07-000001:0:p",
        "_score": 1,
        "_source": {
          "@timestamp": "2023-02-02T15:54:22.727Z",
          **"tags": [**
**            "Earth"**
**          ],**
          "metricset": {
            "period": 10000,
            "name": "shard"
          },
          "service": {
            "address": "http://localhost:9200",
            "type": "elasticsearch"
          },
          "elasticsearch": {
            "shard": {
              "relocating_node": {},
              "state": "STARTED",
              "primary": true,
              "source_node": {
                "uuid": "vCvc1I0mR0exEf8pCdH8Gw",
                "name": "LIN80024256"
              },
              "number": 0
            },
            "cluster": {
              "state": {
                "id": "Q7mdohkVSO-ZPvOI2Wv3Vg"
              },
              "stats": {
                "state": {
                  "state_uuid": "Q7mdohkVSO-ZPvOI2Wv3Vg"
                }
              },
              "id": "eHOPW-2ITs-WrFtx15BaHg",
              "name": "elasticsearch"
            },
            "node": {
              "id": "vCvc1I0mR0exEf8pCdH8Gw",
              "name": "LIN80024256"
            },
            "index": {
              "name": ".ds-ilm-history-5-2022.07.07-000001"
            }
          },
          "event": {
            "duration": 7798100,
            "dataset": "elasticsearch.shard",
            "module": "elasticsearch"
          },
          "ecs": {
            "version": "8.0.0"
          },
          "host": {
            "hostname": "LIN80024256",
            "architecture": "x86_64",
            "os": {
              "build": "22000.1455",
              "type": "windows",
              "platform": "windows",
              "version": "10.0",
              "family": "windows",
              "name": "Windows 10 Pro",
              "kernel": "10.0.22000.1455 (WinBuild.160101.0800)"
            },
            "id": "76c8f942-b7a2-4de8-bd0a-7146780917c2",
            "ip": [
              "169.254.81.199",
              "169.254.81.182",
              "169.254.63.129",
              "192.168.40.67"
            ],
            "mac": [
              "14:cb:19:bc:26:62",
              "d0:3c:1f:13:c0:45",
              "d0:3c:1f:13:c0:46",
              "d2:3c:1f:13:c0:45"
            ],
            "name": "LIN80024256"
          },
          "agent": {
            "id": "42c6c88f-fa85-44b4-bf7b-6ce08ce8542c",
            "name": "LIN80024256",
            "type": "metricbeat",
            "version": "8.3.1",
            "ephemeral_id": "177261c5-04dc-4e9c-b833-89b211dfe16e"
          }
        }
      },

But when searched with the following queries its shows NIL

GET .monitoring-es-8-mb*/_search
{
  "query": {
    "exists": {
      "field": "tags"
    }
  }
}

GET .monitoring-es-8-mb*/_search
{
  "query": {
   "match": {
     "tags": "Earth"
   }
  }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.