Can't create new index pattern after deleting all

[Primeval]

Hi,
I deleted all my index patterns (I still have few indexes in elasticsearch, also visible from management in kibana). Right now I wanted to create new (first) index pattern, but there is message:

No default index pattern. You must select or create one to continue.

but I can't create one because of screen is only showing message above and:

Checking for Elasticsearch data

so basically, I need to have default index pattern to create one, but I can't assign any index to be default, because I don't have any index pattern

I am on Windows and I am using version 6.5.4 of Kibana and Elasticsearch.

Do you have any idea how to proceed?

[LeeDr (Lee Drengenberg)]

Hi Primeval,

I would try these steps;

1. open Kibana in a new incognito (private) browser window (which browser are you using by the way?)
2. open the browsers dev console
3. try to create an index pattern (note if you see any errors in the browsers console)

Occasionally the Kibana Index Pattern screen doesn't realize something has updated the .kibana index and it "stale". In some cases just hitting the browser's refresh button will fix this. But opening Kibana in a new incognito window will surely fix that issue. Or it could be something else...

Lee

[Primeval]

Hi,
Thank you for your response.
I followed your steps and I find out that after clicking "Create index pattern", {kibana}/elasticsearch/*/_search is returning 400, but this is strange, because from dev tools with: "GET _cat/indices" I am getting list of indexes from elasticsearch.

[LeeDr (Lee Drengenberg)]

That GET _cat/indices is showing indices in Elasticsearch, not the index pattern you're trying to create in Kibana. To see the index patterns you would do a search against the .kibana index. Something like;

GET .kibana/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "match_phrase": {
            "type": "index-pattern"
          }
        }
      ],
      "minimum_should_match": 1
    }
  }
}

To see if there's a default index pattern (and other configuration settings) you would check;

GET .kibana/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "match_phrase": {
            "type": "config"
          }
        }
      ],
      "minimum_should_match": 1
    }
  }
}

[LeeDr (Lee Drengenberg)]

Also, are you running the default distribution (you see things like Canvas and Monitoring in the left Navigation panel).
And are you on the default Basic license, which would mean no security?
Or the Trial license which allows security to be enabled?
And a clean install, or upgrade from a previous version?

[Primeval]

I am using default basic license.
Regarding my problem, I found out that It only exist when I am accessing Kibana outside from server it is installed on, locally I was able to create new index and set it to default one.
On that server I used IIS reverse proxy to access Kibana on port 80.

But when I was accessing Kibana by reverse proxy, everything worked, I was able te see Logs in Discover or data in dashboards, there was only problem with this request: {kibana}/elasticsearch/*/_search

[LeeDr (Lee Drengenberg)]

If you search this forum you might find some other users using IIS. But more often we have users using NGINX reverse proxy. You might find a solution by searching for proxy in this forum;

https://discuss.elastic.co/search?q=pro%20category%3A7