Discovery and TSVB, doesn't recognize index patterns change

Elastic Stack Elasticsearch
1

I have 4 index patterns with data from diferents sources, in the index pattern section of Kibana I can see the different fields of the indexes, but in discovery and TSVB the fields remain the same when I change the index pattern to visualize the data.

I have work with, 7.5, 7.6, and never have this problem.

[UPDATE]
I realize that Discovery and TSVB always show me the fields of the default index pattern (mixed with some fields of the other indexes), so I delete them all, recreated other index that wasnt the default, and still get the fields of the old default index pattern! fields that doesnt exist in the actual index.

[UPDATE 2]

now I have just one index pattern, I use this in the dev tools

GET /my-new-index/_mapping

and I get the mapping of the old default index, but I erase that index pattern, the mapping should not exists acording to this Documentation
you just need to delete the index to erase the mapping.....I dont know what is going on

2

It sounds like this is not a Kibana issue, but a problem with Elasticsearch mappings.

Maybe you configured an index template bringing back these old mappings?

1 Like
3

it seems to be that, I dont have any index template defined, I have deleted the indexes in elasticsearch, reindex the data without creating any index pattern, and then go to index management (in the elastic section) and check the mapping, and still have the mapping of the old index pattern, but that mapping should not exists. :man_shrugging:

So any time a create an index in elasticsearch with logstash, automaticaly get the mapping of the old default index pattern. but again, that mapping shouldnt exist.

4

So you are not creating this index manually, it's Logstash doing it on your behalf? In that case there might be something off in the Logstash config.

1 Like
5

yes, logstash index the documents, but in the output I only have the elasticsearh output, no additional setting, I have done this many times, but this have never happend before.

usualy i index the documents with logstasth, with no mapping, and then when Im shure that everything is OK i create a mapping for that index.

but the old mapping is somehow saved in elastic, because in logstash I dont have any aditional configuration.

output{
#    stdout{ codec => rubydebug }
    elasticsearch { hosts => ["my_ip:9200"] index => "metrics-new-index-%{+YYYY.MM}"}
}

and, yes, the other outputs have a different index name

6

Unfortunately I'm not sure what could cause this, could you post this question again in the Elasticsearch forum? Make sure to include snippets from how the mapping looks vs. how you expect it to look in the post.

1 Like
7

My bad, I didn't set the independent pipelines in pipelines.yml, I was using the default main, with wildcard, so all the pipelines were mixed. :man_facepalming:

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.