Deleted Index Patterns, how do i get back up and running?

[L33T]

Hi,

I made a silly mistake and removed the index patterns, now when i add them back all my dashboards are broken as is the searches that i had created. Is it possible to fix that and re-associate to the index patterns i had before, they have the same name?

regards,

[MariumHassan]

Hi,
Go to Kibana /Management/Objects/Saved Visualizations, and click on any visualization. You'll see something like this:

{
  "index": "elasticsearch-logs*",
  "query": {
    "match_all": {}
  },
  "filter": []
}

Here you can change the name of your index pattern in "index" to see if the visualization is still working with the current index pattern. This might be a quick fix just to test or you can do it if you don't have a lot of searches/visualizations/dashboards etc. If it still doesn't work that probably means that your pattern has changed, and that is why it is not working. Also, try to load some data in your pattern. There are some fields which are created later or scripted fields might cause problem if they are included.

[L33T]

Hi,

Checking the visualization i get:

{
"index": "winlogbeat-",
"query": {
"query_string": {
"query": "",
"analyze_wildcard": true
}
},
"filter": []
}

That seems to have the same name with both the old index and the re-created index e.g. winlogbeat-*?

How do i load data into a pattern? Sorry i`m pretty new so picking this up as i can.

regards,

[MariumHassan]

Does it display any error? I think it should display an error when you try to open any visualizations etc.

Hit http://localhost:9200/_cat/indices?v to check your index and number of documents inside it.

[L33T]

Hi,

Yep, lots of items in there when hitting that URL.

Visualisation wise i have performed the following:

kibanaSavedObjectMeta.searchSourceJSON

{
"index": "dfd345c0-44b3-11e8-845b-4734b93bc7dd",
"query": {
"query": {
"query_string": {
"query": "",
"analyze_wildcard": true,
"default_field": ""
}
},
"language": "lucene"
},
"filter": []
}

I have changed the index from winlogbeat-* to dfd345c0-44b3-11e8-845b-4734b93bc7dd (which i found by creating a new search looking to see what it was using.. Not sure if thats the right way of doing it but the visualisations are working. Same with the searches... I fear doing this that it wont be as dynamic as when it had winlogbeat-* before

[MariumHassan]

This simply means that your index is "dfd345c0-44b3-11e8-845b-4734b93bc7dd", and all your visualizations are getting data from that index. You need to change your index name to "winlogbeat-*", and for that you must have an index with the same name when you check your elasticsearch indices entries using that url. If the index "winlogbeat-*" is present there but you are unable to use it in your previous searches/visualizations/dashbaords, and those work fine with "dfd345c0-44b3-11e8-845b-4734b93bc7dd", then you need to find out the difference between the two using: Kibana/Management/Index Patterns
There you can see all the fields present in both of your indices.

[L33T]

I can only see one indicie called winlogbeat-* with 869 fields in but when using this in my dashboards etc it comes up invalid..