Cant create index-patterns in other Workspaces

[CamTheMan (Cam)]

Hello, We recently upgraded Elastic and Kibana from version 6.4.2 to 6.8.3.
Migration went fine, dashboards and searches moved across to the 'default' workspace, however when settings up NEW workspaces for other teams etc, there are no index-patterns, and when I try 'create index pattern' it returns an error saying "Couldn't find any Elasticsearch data"

I definately have data in my indexes as I can see it and explore from the "Default" workspace.

Where would I start troubleshooting this error?

Incase you dont believe I have data here is a snippet from /_cat/indices

green open packetbeat-6.8.3-2019-10          0i_P4EBfSjWMkUzILNNBkw 3 1  50560926        0  21.7gb  10.8gb
green open auditbeat-6.8.0-2018-07           GelRfmRgRBu8r5CiggLN3w 3 1        28        0 177.7kb    89kb
green open syslog-2019-04                    licyot9pRlKGCdaCsci-kw 5 1 311141179        0 115.4gb  57.7gb
green open logstash-2019-05                  kBefRVn_RyWs7qtYFoYbfw 5 1 219179680        0 135.3gb  67.6gb

UPDATE: I cant add index-patterns even in the default workspace. I deleted an index-pattern as a test and can't re-add it due to the above error.

[azasypkin]

Hi @CamTheMan,

Can you enable verbose logging in Kibana and check if you see any suspicious error messages? Also do you see any errors in browser console?

Best,
Oleg

[CamTheMan (Cam)]

Hi Everyone,
Just to post an update, what fixed it was one of two things.
A full cluster restart of the elastic nodes - But the reason for the cluster restart was to address a Rancher v.1.6 / Docker / Java bug where Java only detects the CPU count as 1 instead of 16!

After checking 'GET /_nodes/os' we saw: "allocated_processors" : 1 instead of 16.

Aftering editing elasticsearch.yml and adding 'processors: 16' and performing a cluster restart I could re-add the Kibana index-patterns.

What I suspect is that the index-pattern 'search' was just timing out although nothing was being logged about that aspect.
Thats all I can suspect.

Hopefully this helps someone.

Thanks again for the other replies.