# Can't set defaultIndex to other index patterns except logstash-\*
**URL:** https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761
**Category:** Kibana
**Created:** [February 28, 2018, 1:41am UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761 "2018-02-28T01:41:31Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@kesha](https://discuss.elastic.co/u/kesha)
#### Post date: [February 28, 2018, 1:41am UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/1 "2018-02-28T01:41:32Z")
I'm using Kibana 5.6.4 and I'm trying to set the defaultIndex in Kibana to other index patterns. It works for logstash-\* pattern, but if I change to other index pattern by hitting the star button in "Settings-Index Pattern", it will throw `Config: Error 404 Not Found: undefined` error message. All the indexes are good in elasticsearch and all the data are shown correctly in Discover at Kibana.
Additionally, I also want to use curl to change that defaultIndex. So I tried the following command:
`curl -XPUT 'localhost:9200/.kibana/index-pattern/5.6.4' -d '{"defaultIndex":"anotherIndex-*"}'`
I think that command is correct and I use the command:`curl -XGET 'localhost:9200/.kibana/config/5.6.4?pretty` to check and It shows the defaultIndex has been changed to anotherIndex-\*. However, the same thing happens when I come to the kibana page, that Config error shows again.
I assume that may be assigned to the same problem, but I don't really know where is it.
Any ideas?
Thanks,
Ke
---
### Author:  [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [February 28, 2018, 6:38am UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/2 "2018-02-28T06:38:46Z")
Any chance you can provide the output of `GET /_cat/indices` and paste verbatim the index names you're trying to use?
---
### Author:  [@kesha](https://discuss.elastic.co/u/kesha)
#### Post date: [February 28, 2018, 7:40am UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/3 "2018-02-28T07:40:50Z")
Hey Tim,
Thanks for your help. I can't access the database right now but I can give you output example.
The output of `GET /_cat/indices` looks like, for example,
`iptables-2018.02.28 (hash id) data size iptables-2018.02.27 (hash id) data size ...etc...`.
There are one week indexes in the elasticsearch till now. I also have other indexes, like `http-*`, `netflow-*`, etc. If I want to set defaultIndex to iptables, then I will use `curl -XPUT 'localhost:9200/.kibana/index-pattern/5.6.4' -d '{"defaultIndex":"iptables-*"}'`.
However, none of them works except logstash-\* and I'm sure that the logstash index looks nothing different from other indexes under `GET /_cat/indices`.
I will post screenshots later when I can access the database.
Ke
---
### Author:  [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [February 28, 2018, 7:47am UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/4 "2018-02-28T07:47:52Z")
Sure, I'm not sure yet what the issue might be, but it would be helpful to see a screenshot (you can blur out whatever you don't want to share) of what you're clicking on right before the 404 happens. Having a visual clue for us to follow along better will get us a bit further
---
### Author:  [@kesha](https://discuss.elastic.co/u/kesha)
#### Post date: [February 28, 2018, 9:01pm UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/5 "2018-02-28T21:01:08Z")
Hi Tim,
The screenshot of `GET /_cat/indices` has attached below. Some indexes have been blurred.
 
For example, I want to change defaultIndex to iptables-\*, then I run a script as follows:
#!/bin/bash
set -euo pipefail
url='localhost:9200'
index\_pattern='iptables-\*'
id='iptables-\*'
time\_field='@timestamp'
curl -XPUT "http://$url/.kibana/config/5.6.4" -d "{"defaultIndex": "$id"}"
Then terminal shows `{"_index":".kibana","_type":"config","_id":"5.6.4","_version":39,"result":"updated","_shards":{"total":2,"successful":1,"failed":0},"created":false}`
If I run `curl -XGET localhost:9200/.kibana/config/5.6.4`, terminal will show
`{"_index":".kibana","_type":"config","_id":"5.6.4","_version":40,"found":true,"_source":{"defaultIndex": "iptables-*"}}`
When I come to the Kibana page, it will show me the error:
---
### Author:  [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [February 28, 2018, 11:18pm UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/6 "2018-02-28T23:18:59Z")
Thanks! Everything looks good on the data side. The curl command that updates the default index pattern must have an issue.
I did some checking and found there is a Kibana API for setting the default index pattern, which is recommended over talking to ES to manipulate the `.kibana` index. An example of using it for setting `anotherIndex-*` looks like:
```auto
`curl -X POST -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"value":"anotherIndex-*"}' http://elastic:changeme@localhost:5601/api/kibana/settings/defaultIndex`
```
I think I see the problem with the method you were trying before:
> [@kesha](#):
>
> {"\_index":".kibana","\_type":"config","\_id":"5.6.4","\_version":40,"found":true,"\_source":{"defaultIndex": "iptables-\*"}}
`defaultIndex` needs to be a reference to the ID of the index pattern object, not the title of it. Say I want my default index to be `foo-*`, which the title of my index pattern. The ID is autogenerated by Elasticsearch, so a working config would look like:
```auto
{
"_index": ".kibana",
"_type": "config",
"_id": "5.6.8",
"_version": 2,
"found": true,
"_source": {
"buildNum": 15616,
"defaultIndex": "AWHep5vUIQiPiDyXd39U"
}
}
```
Note the lack of reference to the `foo-*` title in the config.
---
### Author:  [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [February 28, 2018, 11:20pm UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/7 "2018-02-28T23:20:31Z")
> [@kesha](#):
>
> curl -XPUT 'localhost:9200/.kibana/index-pattern/5.6.4' -d '{"defaultIndex":"anotherIndex-\*"}'
BTW, `index-pattern` is not the right type for this type for the document you want, so this command doesn't create anything useful.
---
### Author:  [@kesha](https://discuss.elastic.co/u/kesha)
#### Post date: [February 28, 2018, 11:54pm UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/8 "2018-02-28T23:54:10Z")
Hey Tim,
Thanks for the impressive explanation! Now I have a clearer mind to my question...
But after I tried that API, the problem is still there. The command I typed is:
`curl -XPOST -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"value":"'iptables-*'"}' http://localhost:5601/api/kibana/settings/defaultIndex`
And my config still looks the same as before, no reference.
`{ "_index" : ".kibana", "_type" : "config", "_id" : "5.6.4", "_version" : 43, "found" : true, "_source" : { "defaultIndex" : "iptables-*" } }`
Only logstash-\* index works. But if I use that command to set defaultIndex to logstash-\*, the config still doesn't show that reference:
`{ "_index" : ".kibana", "_type" : "config", "_id" : "5.6.4", "_version" : 43, "found" : true, "_source" : { "defaultIndex" : "logstash-*" } }`
How can I make that happen?
Ke
---
### Author:  [@kesha](https://discuss.elastic.co/u/kesha)
#### Post date: [March 1, 2018, 1:41am UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/9 "2018-03-01T01:41:44Z")
Hey Tim,
There's something new. When I run `curl -XGET localhost:9200/.kibana/_search?pretty -d '{"query": {"match": {"_type": "config"}}}'`, I found the reference is on the old version:
Maybe that causes the reference problem?
---
### Author:  [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [March 2, 2018, 12:02am UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/10 "2018-03-02T00:02:22Z")
I have to recommend that you delete all the documents from your `.kibana` index that have the `defaultIndex` field. The documents you have there right now are not usable, and likely just confusing Kibana.
Start over with cleaner data, and try setting different defaults using the UI before trying to do so using the API
---
### Author:  [@kesha](https://discuss.elastic.co/u/kesha)
#### Post date: [March 2, 2018, 9:43pm UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/11 "2018-03-02T21:43:57Z")
Thank you for your help Tim!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 30, 2018, 9:44pm UTC](https://discuss.elastic.co/t/cant-set-defaultindex-to-other-index-patterns-except-logstash/121761/12 "2018-03-30T21:44:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.