What actually is happening..??
What Kibana and ES versions are you running? Any errors in your Kibana and Elasticsearch logs?
I've been experiencing the same issue with POC environment for one of my customers.
I was running Elasticsearch 1.5.1 and Kibana 4.1.1 and the only way I seem to be able to fix this is by removing all indices completely which generally works for approximately a week then falls over again. (I was previously running Curator but have commented out the cron job that calls this).
I was previously getting simultaneous issues with shard failures which I have resolved by tuning the heap size. I hoped this was causing the Kibana error but this occurred again today.
In terms of sizing, this is a proof of concept platform to understand the scaling requirements for an ELK stack but with an Elasticsearch cluster, not the single node it currently resides on. Current data volumes are approximately 40000-80000 log events per minute (hence knowing that we need to scale out to an Elasticsearch Cluster).
For reference, I have other ELK environments running at other customer sites don't exhibit any issues, though their data volumes are considerably lower.
After today's failure, I upgraded to Elasticsearch 1.7.1... lets see if this helps.
Update:
The single node Elasticsearch instance managed to survive for 16 days before Kibana could find no results.
The cluster status was showing as red with a single failed .marvel shard.
Can anyone advise on this?
Is it simply a scaling issue processing so many events on a single node that will be alleviated by adding Elasticsearch nodes and distributing and replicating the shards perhaps?
Facing same issue with ES 1.7.0 and Kibana 4.1.2. The index is there for the given time range but Kibana is unable to show it. ES responds correctly on queries over the index through "curl". Any help here?
It manifested in a "Failed to execute [...] while moving to second phase" error in elasticsearch. Closer examination of the indices, I saw there was a weird looking index created with just a hyphen in the end. Something like "logstash-id1-" ... with nothing in it. Once I deleted it, Kibana worked just fine and no errors seen in ES log as well.