I can't create indexes patterns with ECK

[Benjamin_Carriou]

Hello everyone,

I just freshly installed an Elastic stack on Kubernetes in following tutorial:
https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html

So I have an elasticsearch cluster of two nodes (test phase;)) + an instance of Kibana that connects to it.

Everything seems to work because everything is in a "green" state:

• Elasticsearch

   kubectl get elasticsearch
  
   NAME    HEALTH   NODES   VERSION   PHASE         AGE
   cloud   green    2       7.1.0     Operational   4h
  

• Kibana

   kubectl get kibana
  
   NAME    HEALTH   NODES   VERSION   AGE
   cloud   green    1       7.1.0     4h
  

I can contact the ES API by filling in the access account (* data has been changed for security reasons *):

curl -u "elastic:pass" https://es.cloud.example.com
{
  "name" : "cloud-es-f2gqfdlsp6",
  "cluster_name" : "cloud",
  "cluster_uuid" : "rHnRmGsWSvyS14rGIyWq3w",
  "version" : {
    "number" : "7.1.0",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "606a173",
    "build_date" : "2019-05-16T00:43:15.323135Z",
    "build_snapshot" : false,
    "lucene_version" : "8.0.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

I can connect to Kibana with the dedicated account and no errors appear.

I deployed filebeat and metricbeat on my k8s cluster and made sure they send their data to my elastic cluster.

This seems to be happening because I do not see any error in the logs and the indices are correctly created in ES:

curl -u "elastic:pass" https://es.cloud.example.com_cat/indices

green open kibana_sample_data_logs            IH22ll_MSEKOMSjNKTN5Lg 1 1    14005     0  21.9mb    11mb
green open .monitoring-es-7-2019.06.03        S5B1_mBrQtCAKxM4ca98Hw 1 1    23617 28468  31.9mb  15.7mb
green open .kibana_1                          2Y427ZARRG6ktI8Z6ePMBg 1 1        0     0    566b    283b
green open metricbeat-7.1.1-2019.06.03-000001 0lIhb99UQ1mf-0ryyk5XTQ 1 1   134396     0 140.3mb  70.3mb
green open .monitoring-kibana-7-2019.06.03    JdWb-TiFROCjfedvrXLN4g 1 1     1676     0   1.1mb 534.5kb
green open .kibana_task_manager               idILcj5mRHOtsYoGhNWxRA 1 1        2     0  74.9kb  45.5kb
green open .kibana                            0qrECl53RcqAoGG2nlLjIg 1 1       30     6   1.2mb 647.8kb
green open .security-7                        5HaugK0CQOauG2CFN6B_Iw 1 1        5     0  80.4kb  40.2kb
green open .kibana_2                          ert8jPjeTHGIhi0S3rb9mw 1 1        0     0    566b    283b
green open filebeat-7.1.1-2019.06.03-000001   DzD2Q4qjQUiV4kDuO4k7ig 1 1 12159278     0  12.4gb   5.5gb

I wish now to be able to discover these indices in kibana by creating index patterns (ex: filebeat- *).

So I'm the classic procedure that seems to work:

The index pattern seems created, however when I click on the tab discover, it returns me to the menu of creation of the index pattern:

It does not seem to find this index pattern previously created.

However, when I go to the tabs "infrastucture" and "logs", the contents of the indexes are displayed:

If I open the chrome admin console, I can see the following message:

Any ideas ?

Benjamin

[jen-huang]

Hi, I believe this is occurring because even though the index pattern is created, it has not been set as the default index pattern for some reason. If you still have the URL of the page in this screenshot, try clicking the Star icon to set it as your default index pattern.

However the concerning part to me is that in the same screenshot, there should be a list of your existing index patterns under the Create index pattern button, but that area is blank in your case.

I would be interested in seeing why that is. Try opening Chrome dev tools, click to Network tab, then navigate Management > Index Pattern. There should be a few requests made to URLs containing saved_objects. Are there any errors associated with those requests? What are the responses?

[Benjamin_Carriou]

Hi @jen-huang and thx for your answer.

When I click on Star icon, nothing is happenning, it's seem be desactivate.

Concerning the requests having in the URL saved_objects, I do not see any error.
Here are the queries and their responses:

kibana-debug-request-response.txt

Here, my k8s ressources:

apiVersion: elasticsearch.k8s.elastic.co/v1alpha1
kind: Elasticsearch
metadata:
  name: cloud
spec:
  version: 7.1.0
  nodes:
  - nodeCount: 2
    config:
      node.master: true
      node.data: true
      node.ingest: true
    volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 100Gi
        storageClassName: cinder-high-speed # can be any available storage class
----
apiVersion: kibana.k8s.elastic.co/v1alpha1
kind: Kibana
metadata:
  name: cloud
spec:
  version: 7.1.0
  nodeCount: 1
  elasticsearchRef:
    name: cloud

Thx for your help

[Benjamin_Carriou]

My problem does not seem isolated:

Created Index Pattern is not visible in KIbana 7.0.1

I have created one index pattern.but the created index pattern is not visible. [image]

[Benjamin_Carriou]

Any ideas ?

[alchy]

@Benjamin_Carriou

When I click on Star icon, nothing is happenning, it's seem be desactivate.

I can confirm the same behavior.

[alchy]

Console screenshot from Firefox I do use. The message says the script-src was blocked due to the security policy.

[Benjamin_Carriou]

I have tried to disable security policy and the problem persist for me

[alchy]

...slowly getting into this...

Is this the request for saved objects please?

http://10.128.2.18:9997/api/saved_objects/_find?type=index-pattern&fields=title&fields=type&per_page=10000

Should this be a response? I would say the empty array is the reason the page says "No default index pattern. You must select or create one to continue.".

{"page":1,"per_page":10000,"total":0,"saved_objects":}

How the request to save an "index pattern object" should look like (the POST URL), which data is expected in json (example pls.) and when it is expected to happen in GUI? It seems this the problem part as I would say the POST did not happen, probably.

Could eventually someone please send me a curl (still learnig ELK) with the packetbeat-* kibana's "index pattern" so I could manually inject to test?

thanks

[alchy]

I've found possible fix:

Wojciech_Kuligowski](https://discuss.elastic.co/u/Wojciech_Kuligowski)

12d

I have finally found solution in another discussion - set kibana.index in kibana.yml to some new name, which causes creating new index for kibana. After restart index patterns work fine.

[Benjamin_Carriou]

@alchy Thanks for your message.
Did you use ECK ?
If yes, how did you do that with CRD ressources ?

[j-klemm (Jakob Klemm)]

I am having the same issue using 3 instances of Elasticsearch 7.1.1 and 3 instances of Kibana 7.1.1 in a Docker Stack over 3 remote machines (EC2s).

I create the index pattern and check that it is saved as default in Advanced Settings.

Then I navigate to Dashboard and it says

In order to visualize and explore data in Kibana, you'll need to create an index pattern to retrieve data from Elasticsearch

Then I check again in Advanced Settings and I've lost the Default Index that was saved.

[alchy]

@Benjamin_Carriou

do that with CRD ressourc

can't help with this, but the fix proven to work on locally installed kibana
maybe I put this as issue to kibana bugtracker as this is a bug

[Benjamin_Carriou]

For me, upgrade to 7.2.0 fix the problem