Topbeat logs not showed in kibana

Elastic Stack Beats
1

Hi,

This is weird because yesterday i could see a graphic with topbeat metrics. However, sinoce 02:00 am i can't se anything coming from topbeat i kibana. Although the logs are received in elasticsearch.
What can i do to isolate this error? where it comes from?

Thanks

2

You can try to use the Kibana Discover tab to check what events are in ES.

3

Yes i did.
That's weird. In discovery i receive logs coming from topbeat. They look ok.
i.e:

{
"_index": "topbeat-2017.05.30",
"_type": "process",
"_id": "AVxY-b-y6TD-zjntkVEw",
"_score": null,
"_source": {
"@timestamp": "2017-05-30T11:00:40.394Z",
"beat": {
"hostname": "host1",
"name": "host1"
},
"count": 1,
"proc": {
"cmdline": "jsvc.exec (deleted....)",
"cpu": {
"user": 77952920,
"user_p": 0.4008,
"system": 4275580,
"total": 82228500,
"start_time": "May25"
},
"mem": {
"size": 7072964608,
"rss": 3001061376,
"rss_p": 0.36,
"share": 6053888
},
"name": "jsvc",
"pid": 1885,
"ppid": 1884,
"state": "sleeping",
"username": "root"
},
"type": "process"
},
"fields": {
"@timestamp": [
1496142040394
]
},
"sort": [
1496142040394
]
}

As you can see, in proc.cpu.user_p there's data (0.40... means 40% as i can see in discovery tab)
However in visualize i see nothing.
i created a area chart, metric is average by proc.user.cpu_p, then x axis is timestamp... but nothing is showed

In settings undex topbeat-* index, the proc.user.cp_p field is of type number and format: Percentage

What i'm missing?

Thanks

4

Do you mean proc.cpu.user_p? I don't see a cpu_p field.

Btw, I strongly recommend upgrading to Metricbeat 5.x. It's compatible with ES 2.x and it fixes tons of things.

5

Hi Tudor,

Yes, i ment proc.cpu.user_p
I solved it by reinstalling the template so you can close this topic.

In case someone is having this issue, try reinstalling topbeat template.

Thanks

6

This topic was automatically closed after 21 days. New replies are no longer allowed.