elastic / elastic/beats

[Stack Monitoring] Metricbeat writes to .monitoring-*-8-mb indice instead of datastream after 8.0 upgrade

Open
#30,769 29 comments 2 reactions 0 assignees View on GitHub
bug Feature:Stack Monitoring Metricbeat Team:Monitoring
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

### Summary

In 8.x, metricbeat writes stack monitoring data to `.monitoring-{product}-8-mb` index patterns. These patterns are backed by datastream templates created by elasticsearch at startup and define the corresponding ILM and mappings necessary for SM to function.

We may have a race condition where an unmapped/unusable indice could be created instead of the expected datastream if elasticsearch didn't setup the backing template when metricbeat start writing data to `.monitoring-{product}-8-mb`.

If scenario is confirmed, we should work on a fix that prevents data from being written to the `.monitoring-{product}-8-mb` patterns until the templates are successfully setup.

This ticket tracks the investigation and resolution of that potential scenario.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.