Index patterns keep disappearing

[mutt13y (Stuart Gall)]

Hi I was experiencing this issue, I see it has been reported previously.

Kibana's default index pattern get deleted automatically

Hi, Kibana 6.7.1 I started to face a weird behavior with Kibana, for an unknown reason when logging in to Kibana it complains that there's no default index-pattern configured I then chose one of the index-pattern from the list and set it as the default, a few minutes later (less than an hour usually), the default index-pattern disappear again. Looking at the Kibana's setting API (/api/kibana/settings) gives this: With default index-pattern in place: {"settings":{"buildNum":{"userValue":202…

As it seems there were no solutions I though I would post my findings.
I determined that the cause was that I had defined a catchall index-template with a lifecycle policy.
The idea was to only keep any unknown index names for 3 days.
This worked fine until we upgraded. I am guessing that .kibana index was recreated and then had the lifecycle policy applied.

there is no warning when creating a '*' index template. IMO this should not apply to system indices.

I raised a bug with elastic

Default lifecycle policy affects system indices

I am only mentioning it here in case others experiance the same issue.

I resolved it by creating a template to match ".*" with no life cycle and a very low priority.

[azasypkin]

Thanks for sharing your finding @mutt13y!