Default index pattern is missing after ES data dir been moved

[Andrew_Liaskovski]

Hi all. I'm having this issue where the default index pattern is no longer default and Kibana needs user to "star" some pattern once again? It happens on my instance not only every time when I restart ELK stack, also it happens periodically.
Pre-conditions are:

Had worked properly up until EBS volume was changed. I had to restore it and copy ES data dir to other location. The reason is a long story )

Docker-compose, here is the volume mount -
- /opt/elasticsearch_data/data:/usr/share/elasticsearch/data

before migration I had rexray ebs driver
elasticsearch_data:
driver: rexray/ebs:latest
and mount
- elasticsearch_data:/usr/share/elasticsearch/data

Now I have:
tree -L 4 /opt/elasticsearch_data/data/
/opt/elasticsearch_data/data/
└── nodes
└── 0
├── indices
│ ├── 0yuAlf28TRKJkLpx5whg7Q
│ ├── yVBDitDpQqeX2Dh4dUIQrA
│ └── zdg0ckv3QvCqtQsGGkndxw
├── node.lock
└── _state
├── global-526.st
└── node-86.st

0yuAlf28TRKJkLpx5whg7Q is .kibana index and here is a tree for it
├── 0
│ ├── index
│ │ ├── _6b_1.liv
│ │ ├── _6b.dii
│ │ ├── _6b.dim
│ │ ├── _6b.fdt
│ │ ├── _6b.fdx
│ │ ├── _6b.fnm
│ │ ├── _6b_Lucene50_0.doc
│ │ ├── _6b_Lucene50_0.pos
│ │ ├── _6b_Lucene50_0.tim
│ │ ├── _6b_Lucene50_0.tip
│ │ ├── _6b_Lucene70_0.dvd
│ │ ├── _6b_Lucene70_0.dvm
│ │ ├── _6b.nvd
│ │ ├── _6b.nvm
│ │ ├── _6b.si
│ │ ├── _6f.cfe
│ │ ├── _6f.cfs
│ │ ├── _6f.si
│ │ ├── _6g.cfe
│ │ ├── _6g.cfs
│ │ ├── _6g.si
│ │ ├── segments_1j
│ │ └── write.lock
│ ├── _state
│ │ └── state-3.st
│ └── translog
│ ├── translog-25.ckp
│ ├── translog-25.tlog
│ ├── translog-26.ckp
│ ├── translog-26.tlog
│ ├── translog-27.ckp
│ ├── translog-27.tlog
│ ├── translog-28.ckp
│ ├── translog-28.tlog
│ ├── translog-29.ckp
│ ├── translog-29.tlog
│ ├── translog-30.ckp
│ ├── translog-30.tlog
│ ├── translog-31.tlog
│ └── translog.ckp
└── _state
└── state-16.st

5 directories, 39 files

GET .kibana/config/_search? shows me
{
"took": 0,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 0,
"max_score": null,
"hits": []
}
}

Thank you for any assistance!

[Bargs (Matt Bargar)]

The default index pattern id is stored in the config document in the .kibana index. I see from the search results you posted that the config document is missing. It must be getting deleted periodically for some reason. I've only ever heard of issues with the config document when upgrading, and even then only at upgrade time, not on a periodic basis afterward. If you can't think of a reason why your environment might be causing this to happen I'd recommend creating an issue on Github.