Index patterns search not finding results of existing index patterns

Elastic Stack Kibana
1

Hi,

I have a number of index patterns which I've imported from a different space. When I try to search for an index pattern which clearly exists in the Index Patterns menu - Kibana doesn't seem to be able to find some of the indexes. Here's a screenshot before performing the search:

Capture
Capture.JPG1281×251 15.5 KB

After performing the search:

Capture
Capture.JPG1232×332 21 KB

The problem also seems to manifest itself when I try to create a metric visualisation using Visual Builder by not finding any documents in the index pattern specified even though selecting the exact same index pattern using the normal metric visualisation yields results:

Capture
Capture.JPG1860×757 55 KB

I've tried deleting and re-creating the index pattern - no change.

There doesn't seem to be any relevant errors or warnings in the kibana logs or elasticsearch logs.

Any ideas on what's happening here?

Thanks,
Gen.

2

Can anyone assist with troubleshooting?

Thanks.

3

You can try and compare the index pattern than works to one that doesn't inside the .kibana index and see if there's something weird when comparing them.

4

There's something weird going on with the .kibana index.

It looks like the index patterns that doesn't work doesn't exist inside the .kibana index.

Also, not sure why but I seem to have multiple .kibana indices e.g.

.kibana_5
.kibana_4
.kibana_3
.kibana_2
.kibana_1
.kibana

Is there a way to re-create the .kibana index from scratch without losing visualisations, index-patterns, spaces etc.?

5

How do I check which .kibana index is being used?

What's weird is when I run

GET "localhost:9200/api/saved_objects/_find?type=index-pattern&fields=title&per_page=10000"

the list of index patterns that are returned contain all the index patterns even the ones that don't work.

When I try to delete some of them though, or create new ones, the changes I make through the API don't reflect the index-patterns I'm seeing in Kibana, even after restarting Kibana and refreshing the page.

6

I've realised that the API changes I make only reflect on the Default space when looking in Kibana.

If I delete an index pattern and re-create it with a different ID then I'm able to search for it in the Index Patterns search field within Kibana but I lose all of my visualisations linked to the pattern.

I've then tried deleting the newly created index-pattern and re-creating it with the old ID but then it no longer becomes searchable again.

Is there a way to control the index-patterns for specific spaces using the API?

7

Worked out how to use the API to target different Spaces from this post:

Looks like my issue will be fixed by recreating the index patterns in each space with new IDs and relinking the visualisations to the new index-pattern.

A bit of work but should sort everything out.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.