Can't delete index pattern in Kibana

Elastic Stack Kibana
1

Hello,

Not sure if it's an Elasticsearch or a Kibana issue.

I removed an index pattern in Kibana and tried to re-create it. It created without any problem, but it seems that the previous one was not deleted correctly. Now in Management >> KIbana >> Index Patterns, I have the same 2 index patterns :

image

The problem is that it's impossible to open one of these index patterns, so I'm not able to delete it and keep just one, I get an error 413 when trying to open it.

Did someone already have this issue?

Thanks in advance

EDIT:

I managed to delete the second index pattern that was created, so now I just have one pattern logstash-fortinet-* but still can't open it. I have a 413 error.

Error: 413 Response
value/<@http://elastic.ctgdcl.lu/bundles/kibana.bundle.js?v=16350:42:40642
processQueue@http://elastic.ctgdcl.lu/bundles/commons.bundle.js?v=16350:29:132456
scheduleProcessQueue/<@http://elastic.ctgdcl.lu/bundles/commons.bundle.js?v=16350:29:133349
$digest@http://elastic.ctgdcl.lu/bundles/commons.bundle.js?v=16350:29:144239
$apply@http://elastic.ctgdcl.lu/bundles/commons.bundle.js?v=16350:29:147007
done@http://elastic.ctgdcl.lu/bundles/commons.bundle.js?v=16350:29:100015
completeRequest@http://elastic.ctgdcl.lu/bundles/commons.bundle.js?v=16350:29:104697
createHttpBackend/</xhr.onload@http://elastic.ctgdcl.lu/bundles/commons.bundle.js?v=16350:29:105435

I deleted the index pattern like this :

  • Found the ID of the pattern with this command

curl -XGET http://localhost:5601/api/saved_objects/index-pattern/

  • Deleted the index pattern:

curl -XDELETE http://localhost:5601/api/saved_objects/index-pattern/8b42f5c0-b68f-11e8-816a-17c8ecbb728b -H "kbn-xsrf: true"

2

Hmm, it sounds like the delete requests aren't going through in Kibana. Are you using a security plugin by chance? Can we take a look at the network request in dev tools to see what's happening when the delete request is sent?

3

Hello,

Thanks for you answer, and sorry for the late reply

Delete requests seems to work fine, I managed to delete the index patterns and recreate it, but I still have the same problem, when I try to open it, it won't let me open, and returns me a 413 error.

I tried to delete an index from the dev tool :

DELETE /logstash-fortinet-2016.12.29

{
"acknowledged": true
}

It seems the problem is with the index pattern. In discover, I can't open logstash-fortinet-*, but if I search logstash-fortinet in dev tool :

GET /logstash-fortinet-2018.09.18

{
"logstash-fortinet-2018.09.18": {
"aliases": {},
"mappings": {
"default": {
"dynamic_templates": [
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"norms": false,
"type": "text"
[etc...]

Thanks

4

Oh! I understand now. Kibana saves a copy of the index pattern's metadata so that we can associate additional data with it. We don't need to delete the index pattern itself, but Kibana's reference to the index pattern.

We'll need to find and delete a single document in the kibana index, and what it looks like depends on the version.

If you do a search on .kibana and look for something that has an index pattern type with a name of logstash-fortinet-* that'll be the document. If you're not able to find it can you let me know your Kibana version and we can get a query written?

5

Hello jbudz,

Thanks for your answer,

I tried to search .kibana index, but couldn't find a pattern type like logstash-fortinet-*.

I used this query to search :

curl -XGET localhost:9200/.kibana?pretty

My version of Kibana is 6.1.1.

Did I use the right query to search Kibana index pattern?

(I tried to add the .kibana index but I had too much character in my message. Is there a way to add it to my message?)

Thanks

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.