Error: Could not locate that index-pattern-field (id :@timestamp)

Elastic Stack Kibana
1

image
image.png1163×26 7.23 KB

Hey, I am using Kibana 6.4.0 with Elasticsearch and getting the above error. I am using Kibana API to create index-pattern and making timeFieldName as @timestamp . Previously, everything was working fine with the above API requests. But, suddenly I changed nothing and came up with this error and unable to get the logs in the UI! I am unable to figure this out. So, can anybody help me out with the fix of this error and explain what the actual error is?
Also, the logs hit in the UI can be seen as some values image , but the UI is showing nothing.
image
image.png1016×536 12.7 KB

2

Does the @timestamp field still exist in your index mapping (GET myindex/_mapping)? If so you may try clicking on the "Refresh field list" icon in Management-Index Patterns and see if that fixes it.

You can also check Kibana's server logs for a possible explanation. Feel free to post relevant logs here if you need help.

3

Thanks for replying, @nickpeihl . Yes, the @timefield field exists in _mapping

 "mappings" : {
      "fluentd" : {
        "properties" : {
          "@timestamp" : {
            "type" : "date"
          },

Kibana server logs doesn't have any error present in it.
But yes, Refresh field list inside the Management-Index Patterns worked for me :+1: . But, I am getting the same error for other index-patterns. So, for the fix, I'll have to go inside every index-pattern and fix it, a hectic and several steps process. So, can you explain me what the real problem is so that I can look into it ? And if there are other ways to fix it for all at once or permanently remove this error?

4

Also, when I get inside the .kibana_user index in elasticsearch and get the data in _search , it shows the result as:

   {
        "_index" : ".kibana_abc",
        "_type" : "doc",
        "_id" : "index-pattern:xyz",
        "_score" : 1.0,
        "_source" : {
          "type" : "index-pattern",
          "updated_at" : "2019-01-03T09:47:22.821Z",
          "index-pattern" : {
            "title" : "xyz-*",
"timeFieldName" : "@timestamp",
            "fields" : "[{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false}]"

And on other index-pattern which are working fine, it has fields as:

   "timeFieldName" : "@timestamp",
            "fields" : "[{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false}, . . .

I thought this might be useful for you .

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.