Index doesn't show up in the dashboard although the status of the index is green

[Manula_Manjitha]

I have setup a filebeat input as follows to read the logs from an application that we are running on the server. The name of the input is the filebeat-2023.10.277.

filebeat.inputs:

- type: log
  id: gateway-elk
  enabled: true
  paths:
    - /home/directfn/app/ntp_gateway/gateway-elk.log

This was done removing the previous input which was a filestream type input. The name of that input was filebeat-2023.10.276.

But in the kibana dashboard, it only shows the deleted index but gives prompt that it can't find that.

And even in the dashboard it doesn't show the current index which is filebeat-2023.10.277 although the status of the index is green.

Please suggest me any solution to rectify this.

[stephenb (Stephen Brown)]

As suggested on the 2nd view try extending the time picker range to from tomorrow to last 30 days.

By default it's only the last 15 minutes, so if your data falls outside that it will not show up.

Also, that is an unusual index naming scheme. Not sure if you're doing that on purpose.

When you create the data view you should not create it the exact name of the index you should do something like pattern

filebeat-*

And just a point of clarification, the name of the input is not directly related to the name of the index the data is written to.

@Manula_Manjitha

- type: log

The log type is deprecatef as well.

[Manula_Manjitha]

The second screenshot that I have provided is showing the deleted index which ends from 276. And the dashboard is still picking that deleted index without picking the current index which ends from 277 which is the only manually created index that exists. The second screenshot shows the evidence for that. I want the index in the last screenshot which is 277 to be in the dashboard instead of the one in the second screenshot which is 266. And for the name, I didn't pick it and it was automatically assigned.

[Stratoula_Kalafateli]

Have you created a dataview for this index? Lens doesn't display indices but dataviews. To create a dataview you have to navigate to Stack Management --> Dataviews page.

[Manula_Manjitha]

Thanks for the comment. It worked