Templating with metricbeat

Grafana Elasticsearch
1

Hi,

i try to use metricbeat data over elastic5 and some are working fine, but the dataformat is a bit fuu.

so i can select hosts, ressource type, but then i have to make dedicated drop down menus for all ressource types, or i can use concate for fieldnames like this (example templating)

"{"find": "terms","field":"system.$Ressource_Type.*", "query":"metricset.name:$Ressource_Type"}"

is this possible?

2

This was a tricky question. Might be possible to do it with a script field (something like this) but I’m not sure.

3

Scripted fields are impossible in the moment, i guess this should be an improvement for Grafana, wich spread the data line into something useful.
In the moment i have to set up graphs per machine very tricky by hand, templating is not working.

4

image
image1303Ă—450 31.3 KB
how to choose field is a variable?

5

Thats the Problem, you can have one out of the field, but you cant “variable” the single key value fields, because the whole value field is the data(value) other data “one key one value” per field.

6

I sit here a bit frustrated to try make a selektion on filtered fieldnames for templating

  • $Machines {“find”: “terms”, “field”: “beat.hostname”}
  • $Ressource_Type {“find”: “terms”,“field”:“exec.json.*”,“query”:“beat.hostname:$Machines”}

I want to select the fields, instead of values in this case, how to make this.

7

Wohoo, one step forward, more questions

$Machines {“find”: “terms”, “field”: “beat.hostname”}
$Ressource_Type {“find”:“fields”,“query”:“beat.hostname:$Machines”}

After that i can use Regex to filter this. But now i have a problem to use this variable in the metrix section. When i have more than one Ressource in the variable, so i cant use that, because $Ressource_Type contains more than one fields, which have values

8

So i am able to break down my problem

  • My Dataformat is one fieldname per ressource
  • value is value part of the $Variable fieldname
  • single graph is unable to query more than one field (OR operator only exists for values, not for fields)
  • single graph is unable to expand $Variables for thedescription

So there is a feature request to make metricbeat data usable in grafana.

  • Querying multiple fields
  • expand $Variables in metric section for single graph and possible others

gra2gra1

1 Like
9

I have the same problem

image
image976Ă—257 8.2 KB
the column name doesn’t change correct