Unable to View Imported Dashboards/Visualizations for Metricbeat

Elastic Stack Beats
1

I am using MetricBeat to capture statistics and send data to Logstash. Logstash then reads input from Beats and sends the data to Elasticsearch. Data is present in Elasticsearch & Kibana index shows the data read from Elasticsearch.

After Downloading and Loading Sample Beats dashboard, the dashboard/Visualizations give an error on opening. The error obtained is:-

Saved "field" parameter is now invalid. Please select a new field.
Visualize: "field" is a required parameter

I have been able to debug the issue & found that the fields containing beat information such as beat.name, beat.hostname are being used by the sample beats dashboard which is non-aggregatable fields. However, when editing the visualization and changing the visualization value from beat.name to beat.name.keyword works and the visualization is shown.

This issue is being observed for all the fields having datatype as string. Such fields without .keyword parameter are non-aggregatable while the fields with .keyword are aggregatable.

Is there any way to solve this issue so that fields without .keyword become aggregatable fields and Dashboard/Visualizations will be shown.

2

Each beat comes shipped with an index template for elasticsearch. If you use Logstash in the middle, you need to load the template manually: https://www.elastic.co/guide/en/beats/metricbeat/5.1/metricbeat-template.html

This should solve your issue. The problem now is that the template will only apply to new indices.

3

If I am sending data from Metricbeat to Logstash & then to Elasticsearch.
While defining in Logstash config file, in Elastcisearch Output if I specify
Template.name & template.path property it will fetch the correct mappings to data in ES.

Is my understanding correct?

4

So you reference the metricbeat template in logstash, correct?

5

Yes will reference the metricbeat template in ES Output Plugin defined in Logstash Configuration file.

6

I never tried it myself but that should work. Can you share your Logstash config?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.