Error: IndexPattern's configured pattern does not match any indices

Guys,

Help me with this error. I'm banging my head against the wall ...

curl http://elastic:changeme@elasticsearch:9200/_cat/indices?v

health status index                             uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   .kibana                           -B11k27dQBSm2nAqxbPPgA   1   1          3            0      9.3kb          9.3kb
yellow open   .monitoring-es-2-2017.04.05       KoGAhVwgQDecyXSr4gmRWg   1   1      16482          132      8.8mb          8.8mb
yellow open   .monitoring-kibana-2-2017.04.05   SjH2d8TJTVSIAqYFqR-Yeg   1   1        980            0    328.6kb        328.6kb
yellow open   .monitoring-data-2                B0aiXh7OTd6FMUTo7yRoiw   1   1          4            0       14kb           14kb
yellow open   .monitoring-logstash-2-2017.04.05 GLTGksuOQMOTLsVbnFLqTw   1   1       1191            0    320.5kb        320.5kb
yellow open   .monitoring-es-2-2017.04.03       53c4JdARSQeD6_UtCzCdOg   1   1         93            8    203.4kb        203.4kb
yellow open   logstash-2017.04.05               0DyyJ81lTgSTtBEiq5kE6Q   5   1   19415189            0      5.7gb          5.7gb

My data is

c url http://elastic:changeme@elasticsearch:9200/logstash-2017.04.05/_search?q=*

....

{  
"_index":"logstash-2017.04.05",
"_type":"logs",
"_id":"AVs_FCLxjbh51Ak7iyis",
"_score":1.0,
"_source":{  
   "path":"/usr/share/logstash/files/hsm.log",
   "@timestamp":"2017-04-05T17:05:35.953Z",
   "data":"2017/03/17 17:42:02",
   "crt":"00059B74",
   "mensagem":"10.0.62.10 auth try, c: 35, 15",
   "@version":"1",
   "host":"6b16565dbcfb",
   "message":"2017/03/17 17:42:02 B39F9B70 00059B74 BA3BDB7F 10.0.62.10 auth try, c: 35, 15",
   "tid":"B39F9B70",
   "cid":"BA3BDB7F"
}

....

And my index pattern default:

curl http://elastic:changeme@elasticsearch:9200/.kibana/index-pattern/_search

{
   "took":1,
   "timed_out":false,
   "_shards":{
      "total":1,
      "successful":1,
      "failed":0
   },
   "hits":{
      "total":2,
      "max_score":1.0,
      "hits":[
         {
            "_index":".kibana",
            "_type":"index-pattern",
            "_id":"log*",
            "_score":1.0,
            "_source":{
               "title":"log*"
            }
         },
         {
            "_index":".kibana",
            "_type":"index-pattern",
            "_id":"*",
            "_score":1.0,
            "_source":{
               "title":"*"
            }
         }
      ]
   }
}

My versions:

Kibana - 5.3
Logstash - 5.3
ElasticSearch - 5.3

Thanks in advance.

Are you adding the index pattern through Kibana?

Yes. My index default pattern was log*. It was setting when I init kibana machine.

Now I don't know how can I change this... but the logstash-2017.04.05 index name should match this pattern.

I would recommend deleting the index patterns and add a new one. Make sure "Index contains time-based events" is checked and you have selected the time-field name.

Ok. I erased index name .kibana and restart the service.

health status index                             uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   .monitoring-es-2-2017.04.05       KoGAhVwgQDecyXSr4gmRWg   1   1      28182          132     14.8mb         14.8mb
yellow open   .monitoring-es-2-2017.04.10       QMKW2h53RG-h0I8VzJxiww   1   1       1251           52    604.2kb        604.2kb
yellow open   .monitoring-kibana-2-2017.04.05   SjH2d8TJTVSIAqYFqR-Yeg   1   1       1879            0    525.8kb        525.8kb
yellow open   .monitoring-data-2                B0aiXh7OTd6FMUTo7yRoiw   1   1          4            0       17kb           17kb
yellow open   .kibana                           YzRW1KVzQiyY-CDWErC7Ow   1   1          1            0      3.1kb          3.1kb
yellow open   .monitoring-kibana-2-2017.04.10   eWLfjcARTju1aNUGMaWiQg   1   1         39            0     40.2kb         40.2kb
yellow open   .monitoring-logstash-2-2017.04.05 GLTGksuOQMOTLsVbnFLqTw   1   1       2091            0    507.2kb        507.2kb
yellow open   .monitoring-es-2-2017.04.03       53c4JdARSQeD6_UtCzCdOg   1   1         93            8    203.4kb        203.4kb
yellow open   logstash-2017.04.05               0DyyJ81lTgSTtBEiq5kE6Q   5   1   19523040            0      5.1gb          5.1gb

Apparently the wildcard doesn't match any index there. The select time field name doesn't open

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.