# Index Pattern doesn't match all the indices

**URL:** https://discuss.elastic.co/t/index-pattern-doesnt-match-all-the-indices/81584
**Category:** Kibana
**Created:** [April 7, 2017, 8:57am UTC](https://discuss.elastic.co/t/index-pattern-doesnt-match-all-the-indices/81584 "2017-04-07T08:57:39Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Emilien](https://avatars.discourse-cdn.com/v4/letter/e/bcef8e/32.png) [@Emilien](https://discuss.elastic.co/u/Emilien)
#### Post date: [April 7, 2017, 8:57am UTC](https://discuss.elastic.co/t/index-pattern-doesnt-match-all-the-indices/81584/1 "2017-04-07T08:57:39Z")

</div>

Hello everyone,

I'm new using ELK and I'm encountering an issue with Kibana.  
I'm importing catalina.out in elasticsearch with logstash.  
In this part, I don't have any particular problem and the indices seems to be corectly created.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/2/5/255a248dced2acf4971658e264bac37b87c49c6f.png)

But when it comes to Kibana I just have 715 hints links to the last logstash index. I tried to created an index pattern from a specific logstash one (ex: logstash-0017.04.03) but in this case I don't have any results.

I'm using Kibana 5.3 and I use the default setup. I didn't configure any specific search and I use the Time range "this year"  
Does anyone have a lead on my issue?

Thank you for your help

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [April 7, 2017, 10:20am UTC](https://discuss.elastic.co/t/index-pattern-doesnt-match-all-the-indices/81584/2 "2017-04-07T10:20:23Z")

</div>

It looks like something is not working in your parsing and that it is extracting the year as 0017 (Will be hard to get this included in the Kibana time picker)). You only have one index covering 2017, so what you see in Kibana appears correct.

---

<div class="post-metadata">

### Author: ![Emilien](https://avatars.discourse-cdn.com/v4/letter/e/bcef8e/32.png) [@Emilien](https://discuss.elastic.co/u/Emilien)
#### Post date: [April 7, 2017, 10:57am UTC](https://discuss.elastic.co/t/index-pattern-doesnt-match-all-the-indices/81584/3 "2017-04-07T10:57:50Z")

</div>

You right, I didn't pay attention in the first place but I have an issue because some logs are matching the pattern TOMCAT\_DATESTAMP2 and others DATESTAMP2.  
I need to convert DATESTAMP2 to TOMCAT\_DATESTAMP2 before I target the @timestamp field.  
Thanks

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [April 7, 2017, 11:07am UTC](https://discuss.elastic.co/t/index-pattern-doesnt-match-all-the-indices/81584/4 "2017-04-07T11:07:55Z")

</div>

I would recommend opening an issue under Logstash. make sure you provide example logs as well as your current configuration.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 5, 2017, 11:14am UTC](https://discuss.elastic.co/t/index-pattern-doesnt-match-all-the-indices/81584/5 "2017-05-05T11:14:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
