Create button does not work when trying to "Use event times to create index names"

Elastic Stack Kibana
1

When I put the settings in the attached image and click create nothing happens. Does anyone know what this would be?

kibana_config.png472×615 20.9 KB

Thank you,

Sean McGilvray

2

Seems like it should work. What version are you using?

Also, is this Kibana instance protected by Shield, by chance? I've seen this behavior when logged-in user didn't have permissions to create index patterns in at the Shield level.

3

Hello Tanya,

Thanks for the reply. I do not have Shield installed. I wish it was just that easy :smile:

My version is in the image below. It looks like a code error from what I am seeing when I inspect the button and there is nothing popping up to say what that error actually is. Anyone got any suggestions on this?

kibana_code_error.png1157×985 54.1 KB

4

Thanks! And what browser are you using?

5

I have tried both IE and Chrome. The same thing happens on both.

6

This is the error that comes up on Chrome console.

7

Think you could grab a screenshot of the request body that's being sent when you click Create? That's coming back from Elasticsearch, but I'm not sure what is 404/not found there.

Also, it probably doesn't matter, but what version of Elasticsearch are you using?

8

Hey Joe,
We are using Elasticsearch 1.7.1

When you click "Create" nothing happens. The only thing I see that comes up is the screen shot that I sent from the Chrome browser that was the last screenshot. The screen shot before that was what IE sees.

9

Right, but it's making a network request to Elasticsearch, it's just that that request fails and the error isn't properly handled (and thus not displayed). You should see it happen in the network tab in your debugger - I'd like to see what the request looks like.

10 
curl "http://libelk.ucr.edu/elasticsearch/.kibana/index-pattern/"%"5Blogstash-"%"5DYYYY.MM.DD?op_type=create" -H "Origin: http://libelk.ucr.edu" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US,en;q=0.8" -H "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36" -H "Content-Type: application/json;charset=UTF-8" -H "Accept: application/json, text/plain, */*" -H "Referer: http://libelk.ucr.edu/" -H "Connection: keep-alive" --data-binary "{""title"":""[logstash-]YYYY.MM.DD"",""timeFieldName"":""@timestamp"",""intervalName"":""days""}" --compressed
11

Hrm, the request looks right - I just tried it locally on 1.7.1 and it worked fine.

I wonder if there was an issue during the setup that wasn't handled correctly that's causing this issue. Can you check to see if the .kibana index exists in your cluster?

12

Hey Joe,
it is there.

kibana_index.png714×196 18 KB

13

Might help earlier if I said this is installed on a Windows 2012 R2 box.

14

15

This error is expected - it happens when there is no default index pattern. The one you posted before, however, is not expected.

Running on Windows shouldn't be an issue. Kibana can talk to your cluster, otherwise you wouldn't even make it to the index pattern screen. Kibana can write to the cluster, otherwise you wouldn't have a .kibana index. The query for setting the index pattern looks right, and it runs fine for me on 4.1.1 and 1.7.1.

I'm kind of out of ideas as to why it's happening. Let me bounce this off some other folks and see what they think.