Delete visualize page from command line?

[isarib (Imran)]

Hi,

I made a change to a visualization page, setting a value for one of fields perhaps too high, then everything of kibana or elasticsearch crashed at that moment.

From the logs, there are messages of:

{"type":"error","@timestamp":"2019-01-23T06:59:55Z","tags":["fatal","root"],"pid":14010,"level":"fatal","error":{"message":"all shards failed: [search_phase_execution_exception] all shards failed","name":"Error","stack":"[search_phase_execution_exception] all shards failed :: {"path":"/.kibana/doc/_count","query":{},"body":"{\"query\":{\"bool\":{\"should\":[{\"bool\":{\"must\":[{\"exists\":{\"field\":\"index-pattern\"}},{\"bool\":{\"must_not\":{\"term\":{\"migrationVersion.index-pattern\":\"6.5.0\"}}}}]}}]}}}","statusCode":503,"response":"{\"error\":{\"root_cause\":,\"type\":\"search_phase_execution_exception\",\"reason\":\"all shards failed\",\"phase\":\"query\",\"grouped\":true,\"failed_shards\":},\"status\":503}"}\n at respond (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:308:15)\n at checkRespForFailure (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:267:7)\n at HttpConnector. (/usr/share/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:165:7)\n at IncomingMessage.wrapper (/usr/share/kibana/node_modules/elasticsearch/node_modules/lodash/lodash.js:4949:19)\n at emitNone (events.js:111:20)\n at IncomingMessage.emit (events.js:208:7)\n at endReadableNT (_stream_readable.js:1064:12)\n at _combinedTickCallback (internal/process/next_tick.js:138:11)\n at process._tickCallback (internal/process/next_tick.js:180:9)"},"message":"all shards failed: [search_phase_execution_exception] all shards failed"}

curl -XGET 'localhost:9200/_cluster/health/balance_sheet?pretty'
{
"cluster_name" : "elasticsearch",
"status" : "red",
"timed_out" : true,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 0,
"active_shards" : 0,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 3,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 3886,
"active_shards_percent_as_number" : 100.0
}

Is there a way in command line to delete the visualization page which I made changes too? I'm happy to drop that one visualize page if it would bring back everything else.

At this moment, I am unable to access kibana webui.

Cheers.

[tsullivan (Tim Sullivan)]

Hi, did you accidentally delete some data files (maybe shards) from Elasticsearch? It looks like your health info is saying your cluster has no shards. That lines up with the error message you see in the logs.

It looks like it's time to restore Elasticsearch data from backup, if you have it.

A saved visualization is a document in Elasticsearch. If you can find the _id of the document, you can delete it by ID with a query: https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete.html

[tsullivan (Tim Sullivan)]

I checked with ES devs about what that health info means.

it means there aren't any copies of that index available (e.g., maybe they shut down their data nodes)

[isarib (Imran)]

Thanks,

All sorted and seems to be working again now.