Can't set defaultIndex to other index patterns except logstash-*

[kesha]

I'm using Kibana 5.6.4 and I'm trying to set the defaultIndex in Kibana to other index patterns. It works for logstash-* pattern, but if I change to other index pattern by hitting the star button in "Settings-Index Pattern", it will throw Config: Error 404 Not Found: undefined error message. All the indexes are good in elasticsearch and all the data are shown correctly in Discover at Kibana.

Additionally, I also want to use curl to change that defaultIndex. So I tried the following command:
curl -XPUT 'localhost:9200/.kibana/index-pattern/5.6.4' -d '{"defaultIndex":"anotherIndex-*"}'
I think that command is correct and I use the command:curl -XGET 'localhost:9200/.kibana/config/5.6.4?pretty to check and It shows the defaultIndex has been changed to anotherIndex-*. However, the same thing happens when I come to the kibana page, that Config error shows again.

I assume that may be assigned to the same problem, but I don't really know where is it.
Any ideas?

Thanks,
Ke

[tsullivan (Tim Sullivan)]

Any chance you can provide the output of GET /_cat/indices and paste verbatim the index names you're trying to use?

[kesha]

Hey Tim,

Thanks for your help. I can't access the database right now but I can give you output example.

The output of GET /_cat/indices looks like, for example,
iptables-2018.02.28 (hash id) data size iptables-2018.02.27 (hash id) data size ...etc....
There are one week indexes in the elasticsearch till now. I also have other indexes, like http-*, netflow-*, etc. If I want to set defaultIndex to iptables, then I will use curl -XPUT 'localhost:9200/.kibana/index-pattern/5.6.4' -d '{"defaultIndex":"iptables-*"}'.
However, none of them works except logstash-* and I'm sure that the logstash index looks nothing different from other indexes under GET /_cat/indices.
I will post screenshots later when I can access the database.

Ke

[tsullivan (Tim Sullivan)]

Sure, I'm not sure yet what the issue might be, but it would be helpful to see a screenshot (you can blur out whatever you don't want to share) of what you're clicking on right before the 404 happens. Having a visual clue for us to follow along better will get us a bit further

[kesha]

Hi Tim,

The screenshot of GET /_cat/indices has attached below. Some indexes have been blurred.

For example, I want to change defaultIndex to iptables-*, then I run a script as follows:
#!/bin/bash
set -euo pipefail

url='localhost:9200'
index_pattern='iptables-*'
id='iptables-*'
time_field='@timestamp'

curl -XPUT "http://$url/.kibana/config/5.6.4" -d "{"defaultIndex": "$id"}"

Then terminal shows {"_index":".kibana","_type":"config","_id":"5.6.4","_version":39,"result":"updated","_shards":{"total":2,"successful":1,"failed":0},"created":false}

If I run curl -XGET localhost:9200/.kibana/config/5.6.4, terminal will show
{"_index":".kibana","_type":"config","_id":"5.6.4","_version":40,"found":true,"_source":{"defaultIndex": "iptables-*"}}

When I come to the Kibana page, it will show me the error:

[tsullivan (Tim Sullivan)]

Thanks! Everything looks good on the data side. The curl command that updates the default index pattern must have an issue.

I did some checking and found there is a Kibana API for setting the default index pattern, which is recommended over talking to ES to manipulate the .kibana index. An example of using it for setting anotherIndex-* looks like:

`curl -X POST -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"value":"anotherIndex-*"}' http://elastic:changeme@localhost:5601/api/kibana/settings/defaultIndex`

I think I see the problem with the method you were trying before:

@kesha

{"_index":".kibana","_type":"config","_id":"5.6.4","_version":40,"found":true,"_source":{"defaultIndex": "iptables-*"}}

defaultIndex needs to be a reference to the ID of the index pattern object, not the title of it. Say I want my default index to be foo-*, which the title of my index pattern. The ID is autogenerated by Elasticsearch, so a working config would look like:

{
  "_index": ".kibana",
  "_type": "config",
  "_id": "5.6.8",
  "_version": 2,
  "found": true,
  "_source": {
    "buildNum": 15616,
    "defaultIndex": "AWHep5vUIQiPiDyXd39U"
  }
}

Note the lack of reference to the foo-* title in the config.

[tsullivan (Tim Sullivan)]

@kesha

curl -XPUT 'localhost:9200/.kibana/index-pattern/5.6.4' -d '{"defaultIndex":"anotherIndex-*"}'

BTW, index-pattern is not the right type for this type for the document you want, so this command doesn't create anything useful.

[kesha]

Hey Tim,

Thanks for the impressive explanation! Now I have a clearer mind to my question...

But after I tried that API, the problem is still there. The command I typed is:
curl -XPOST -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"value":"'iptables-*'"}' http://localhost:5601/api/kibana/settings/defaultIndex
And my config still looks the same as before, no reference.
{ "_index" : ".kibana", "_type" : "config", "_id" : "5.6.4", "_version" : 43, "found" : true, "_source" : { "defaultIndex" : "iptables-*" } }

Only logstash-* index works. But if I use that command to set defaultIndex to logstash-*, the config still doesn't show that reference:
{ "_index" : ".kibana", "_type" : "config", "_id" : "5.6.4", "_version" : 43, "found" : true, "_source" : { "defaultIndex" : "logstash-*" } }

How can I make that happen?

Ke

[kesha]

Hey Tim,

There's something new. When I run curl -XGET localhost:9200/.kibana/_search?pretty -d '{"query": {"match": {"_type": "config"}}}', I found the reference is on the old version:

Maybe that causes the reference problem?

[tsullivan (Tim Sullivan)]

I have to recommend that you delete all the documents from your .kibana index that have the defaultIndex field. The documents you have there right now are not usable, and likely just confusing Kibana.

Start over with cleaner data, and try setting different defaults using the UI before trying to do so using the API

[kesha]

Thank you for your help Tim!