0

Metricbeat sent some data through logstash into opensearch. After first hit I set proper Index Pattern to read incoming data:

system.cpu.pct Index Pattern

incoming datasets with system.cpu.pct

Everything looks fine until I want to create a vizualization (line chart or table) for this data: Line chart for system.cpu.pct

Looks like there is some issue with this data format (?), however I tried to set this parameter as well as number but got the same result. What more I have to set to get proper chart for this data?

  • I changed Index Pattern settings but nothing happend
  • I tried to use another similar property (system.cpu.system.pct) but got the same result
hcz
  • 53
  • 4
  • have you selected the correct time window? – glenacota Mar 03 '23 at 13:35
  • yup, as you can see in ss above, there are several columns in selected time scope but with value 0 – hcz Mar 06 '23 at 07:21
  • 1
    could you please share the mapping of the index? – glenacota Mar 06 '23 at 10:59
  • @glenacota Okay, so that problem appeard when I built logstash and opensearch on localhost through docker-compose.yml, however finally I got a VM so I deployed all over there and looks like there is no problem with data visualization. I also used a filter for this property before dashboard creation. https://i.stack.imgur.com/QkNgE.png Unfortunately I don't have that localhost state saved somewhere but I suppose that map shouldn't changed because it wasn't modified by anyone. https://i.stack.imgur.com/Jy2Qi.png – hcz Mar 08 '23 at 06:59
  • okay, problem occured again, but this time I see that mapping for this property is wrong, and type is long instead of float: `{ "metricbeat-7.10.0-2023.03.09" : { "mappings" : { "host.cpu.pct" : { "full_name" : "host.cpu.pct", "mapping" : { "pct" : { "type" : "long" } } } } } }` – hcz Mar 09 '23 at 13:34
  • however I can't change it manually. May it be a problem with logstash? – hcz Mar 09 '23 at 13:50

1 Answers1

1

Okay, so the problem was automapping of that property. When I introduced a template before indices were created, the data looks fine.

GET _index_template/metricbeats-template enter image description here

GET metricbeat-7.10.0-2023.03.09/_mapping/field/host.cpu.pct

enter image description here

enter image description here

hcz
  • 53
  • 4