Index patterns search not finding results of existing index patterns

Hi,

I have a number of index patterns which I've imported from a different space. When I try to search for an index pattern which clearly exists in the Index Patterns menu - Kibana doesn't seem to be able to find some of the indexes. Here's a screenshot before performing the search:

After performing the search:

The problem also seems to manifest itself when I try to create a metric visualisation using Visual Builder by not finding any documents in the index pattern specified even though selecting the exact same index pattern using the normal metric visualisation yields results:

I've tried deleting and re-creating the index pattern - no change.

There doesn't seem to be any relevant errors or warnings in the kibana logs or elasticsearch logs.

Any ideas on what's happening here?

Thanks,
Gen.

Can anyone assist with troubleshooting?

Thanks.

You can try and compare the index pattern than works to one that doesn't inside the .kibana index and see if there's something weird when comparing them.

There's something weird going on with the .kibana index.

It looks like the index patterns that doesn't work doesn't exist inside the .kibana index.

Also, not sure why but I seem to have multiple .kibana indices e.g.

.kibana_5
.kibana_4
.kibana_3
.kibana_2
.kibana_1
.kibana

Is there a way to re-create the .kibana index from scratch without losing visualisations, index-patterns, spaces etc.?

How do I check which .kibana index is being used?

What's weird is when I run

GET "localhost:9200/api/saved_objects/_find?type=index-pattern&fields=title&per_page=10000"

the list of index patterns that are returned contain all the index patterns even the ones that don't work.

When I try to delete some of them though, or create new ones, the changes I make through the API don't reflect the index-patterns I'm seeing in Kibana, even after restarting Kibana and refreshing the page.

I've realised that the API changes I make only reflect on the Default space when looking in Kibana.

If I delete an index pattern and re-create it with a different ID then I'm able to search for it in the Index Patterns search field within Kibana but I lose all of my visualisations linked to the pattern.

I've then tried deleting the newly created index-pattern and re-creating it with the old ID but then it no longer becomes searchable again.

Is there a way to control the index-patterns for specific spaces using the API?

Worked out how to use the API to target different Spaces from this post:

Looks like my issue will be fixed by recreating the index patterns in each space with new IDs and relinking the visualisations to the new index-pattern.

A bit of work but should sort everything out.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.