Dropping dodgy index pattern names like %{indexname}-2016.08.24

Elastic Stack Kibana
1

We have a wrongly named index pattern created in our .kibana index file.
The index name is in the format of %{indexname}-2016.08.24, which is set as both the title and the _id
The template cannot be removed from within the Kibana GUI as it returns an error.. probably related to the special characters
I have tried multiple combinations to retrieve that index pattern via the ElasticSearch curl interface but am struggling to match it due to the special characters.

Any ideas anyone :slight_smile: ?

Many Thanks

2

Your index pattern starts with %? I'm trying to do that locally, but I just get an error when I create a pattern like that.

$ curl -XPUT 'http://localhost:9200/%char-test'
{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"invalid escape sequence `%ch' at index 0 of: %char-test"}],"type":"illegal_argument_exception","reason":"invalid escape sequence `%ch' at index 0 of: %char-test"},"status":400}

How'd you even create that?

3

By having the output of logstash like the below, and not assigning indexname to anything :slight_smile:

output {
elasticsearch {
host => localhost
index => "%{indexname}-%{+YYYY.MM.dd}"
}
}

4

Ah, %{} is the substitution. Sorry, I misunderstood.

I'd like to see the actual name of the index pattern you have. Mind sharing the results of your index-pattern in the .kibana index?

GET .kibana/index-pattern/_search
{
  "_source": {
    "excludes": "fields"
  }
}
5

Here are the dodgy index-pattern(s) :slight_smile:

{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"failed" : 0
},
"hits" : {
"total" : 16,
"max_score" : 1.0,
"hits" : [
{
"_index" : ".kibana",
"_type" : "index-pattern",
"_id" : "%{indexname}-2016.08.24*",
"_score" : 1.0,
"_source" : {
"timeFieldName" : "@timestamp",
"title" : "%{indexname}-2016.08.24*"
}
},
{
"_index" : ".kibana",
"_type" : "index-pattern",
"_id" : "%{indexname}-2016.11.24",
"_score" : 1.0,
"_source" : {
"timeFieldName" : "@timestamp",
"title" : "%{indexname}-2016.11.24"
}
},
{
"_index" : ".kibana",
"_type" : "index-pattern",
"_id" : "%{indexname}-2016.12.07",
"_score" : 1.0,
"_source" : {
"timeFieldName" : "@timestamp",
"title" : "%{indexname}-2016.12.07"
}
}
]
}
}