I have a standard gold image that includes a pre-configured ELK installation put together by another group. This is my first time working with the software, so I'm trying to see if I'm maybe I'm just doing something wrong.
There are two systems deployed from the same gold image, both with 4.3.1 build 9517 on them. I spent quite some time building and configuring the searches, visualizations, and dashboards that I want to use, and now I want to export them and copy them onto the second system. Nothing within the search/viz/dash data is in any way specific to the first installation so far as I am aware. Exporting the data completes without issue, and I can clearly read it in NotePad++.
When I attempt to import the data onto the second server, I get an error that says "Unable to get property 'service' of undefined or null reference", and the import fails immediately. In the More Details section, the following information appears.
Saved Objects: Unable to get property 'service' of undefined or null reference
OK
I'm approaching this from the end-use perspective, so forgive me if I'm not the most clear as I respond about the configuration. For example, I'd never heard of or seen anything about the Index Pattern before you asked. After a quick primer, I'm at least moderately familiar.
The system we're shipping is pre-configured with ELK already up and running, but effectively blank. As part of this, there is a single Index pattern (cleverly called logstash-*, go figure) pre-loaded into the installation. I've made no adjustments to this setup as I didn't know it existed until now, and so both systems have an identical index pattern with identical parameters out of the box. As I understand it, this should have been successful, then. Theoretically, if I never mess with those parameters, all installations should be cross-compatible until I start adding scripted fields or modify the index settings.
As a result, I thought it was relating to the contents of my export files. To evaluate this, I went into Discover, ran a search for *, exported that search as a saved search, and imported it onto the second box. Identical error as described above. Exploring the JSON file, the term 'service' does not appear in the file itself in any way, so I have to assume, based on what I understand, that this is an internal error of some sort?
Edit: changed 'security' to 'service', was looking at a document with the word Security on it and transferred it to my typing.
I actually have some good news. The issue turned out to be heap sizes; for whatever reason, the Java heap size on the second Kibana installation was drastically (as in a power of ten) lower than the first install. No idea why, but it was apparently too small to function properly. My colleague was digging into the problem with me, and discovered it this morning. After modifying the heap sizes, the import worked without issue. I have no idea why it wouldn't import even the tiniest bits of data (single-term searches and such), but still allowed me to do complex dashboards and visualizations without issue.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
