There is no data to display


#1

Hello World!

I'm trying out Infrastructure (infra) Kibana' app, yet getting following message:

There is no data to display.

metricbeat-* exists with some data in it (mostly from system module)

Please advise.


(Sonja Krause Harder) #2

Hello @alexus :slight_smile:

How are you sending your data to elasticsearch, with metricbeat or through logstash? The UI relies on the correct index template to be used for the metricbeat-* indices, which should work out of the box when you use metricbeat, but might need some extra setup when you use logstash.

In detail, we rely on certain fields containing strings being of type keyword (not text). To check if that could be the cause of your problem, could you give us a sample of the output when querying

/metricbeat-*/_mapping/doc/field/beat.hostname

on your Elasticsearch API?


#3

data is being shipped by metricbeat directly into elasticsearch and template metricbeat-6.6.0 is in place.

GET /metricbeat-*/_mapping/doc/field/beat.hostname
{
  "metricbeat-6.6.0-2019.02.08" : {
    "mappings" : {
      "doc" : {
        "beat.hostname" : {
          "full_name" : "beat.hostname",
          "mapping" : {
            "hostname" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        }
      }
    }
  }
}

(Chris Cowan) #4

Looks like the index templates are not installed correctly for metricbeat-*. Are you sending Metricbeat through Logstash or Kafka or some other intermediary? The only reason I ask is when Metricbeat starts sending data it creates an index template for metricbeat-*. You might have to manually run metricbeat setup before you start indexing through an intermediary.

This link to our documentation goes into detail... https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-template.html


#5

As I mentioned in my previous comment, metricbeat ships events directly into elasticsearch and template is there as well:

# curl --silent --request GET $ELASTICSEARCH_URI/_cat/templates/metricbeat-*
metricbeat-6.6.0 [metricbeat-6.6.0-*] 1 
#

#6

I went to Kibana -> Management -> Saved Objects and removed everything related to *beat, followed by deleting relevant templates as well, then I re-run setup and now it's seems to be working fine)


(Chris Cowan) #7

Awesome! I'm glad we could get you pointed in the right direction.