Kibana 4 initial configuration doesn't pick up the expected indices

Elastic Stack Elasticsearch
1

Hi,
I'm installing Kibana 4.0.0 on Linux x86, using ES 1.5.0 as a back end.
All data in ES is fed through logstash but there is no common prefix like
"logstash-*".
All indices are daily based, e.g. "analytics-2015.04.25".

On Kibana's initia settings page I do:

  1. Check on the "Index contains time-based events"
  2. Check OFF the "Use event times to create index names"
  3. Put the following in the pattern field: "[*-]YYYY.MM.DD"

But the button below the pattern field is grayed out and says "Unable to
fetch mapping. Do you have indices matching the pattern?".
Here is a screenshot:

https://lh3.googleusercontent.com/-G12Fj-SnUmQ/VT2bnbiAPyI/AAAAAAAAO1I/Um5kAYDcY0A/s1600/Screen%2BShot%2B2015-04-27%2Bat%2B12.14.16%2Bpm.png
If I tick on the "Use event times to create index names" then I get
"Pattern matches 0% of existing indices and aliases":

https://lh3.googleusercontent.com/-hcG6sXH8L_c/VT2cLo283TI/AAAAAAAAO1Q/sYWGRiWlMN0/s1600/Screen%2BShot%2B2015-04-27%2Bat%2B12.16.58%2Bpm.png

  1. What am I doing wrong?
  2. Do I have to check the "Use event times to create index names" ON or OFF?
  3. (bonus question): Is there a static file which contains these settings?
    Eventually I intend to configure this using Puppet if possible.

Thanks.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/c65c16e6-1f98-4105-8096-8bd69e8ba1dd%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

You cannot use wild card prefixes.

There is functionally no difference between * and *-something, as each
index has to be checked to see if it matches, so you might as well just use
*.

On 27 April 2015 at 12:19, Amos S amos.shapira@gmail.com wrote:

Hi,
I'm installing Kibana 4.0.0 on Linux x86, using ES 1.5.0 as a back end.
All data in ES is fed through logstash but there is no common prefix like
"logstash-*".
All indices are daily based, e.g. "analytics-2015.04.25".

On Kibana's initia settings page I do:

  1. Check on the "Index contains time-based events"
  2. Check OFF the "Use event times to create index names"
  3. Put the following in the pattern field: "[*-]YYYY.MM.DD"

But the button below the pattern field is grayed out and says "Unable to
fetch mapping. Do you have indices matching the pattern?".
Here is a screenshot:

https://lh3.googleusercontent.com/-G12Fj-SnUmQ/VT2bnbiAPyI/AAAAAAAAO1I/Um5kAYDcY0A/s1600/Screen%2BShot%2B2015-04-27%2Bat%2B12.14.16%2Bpm.png
If I tick on the "Use event times to create index names" then I get
"Pattern matches 0% of existing indices and aliases":

https://lh3.googleusercontent.com/-hcG6sXH8L_c/VT2cLo283TI/AAAAAAAAO1Q/sYWGRiWlMN0/s1600/Screen%2BShot%2B2015-04-27%2Bat%2B12.16.58%2Bpm.png

  1. What am I doing wrong?
  2. Do I have to check the "Use event times to create index names" ON or
    OFF?
  3. (bonus question): Is there a static file which contains these settings?
    Eventually I intend to configure this using Puppet if possible.

Thanks.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/c65c16e6-1f98-4105-8096-8bd69e8ba1dd%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/c65c16e6-1f98-4105-8096-8bd69e8ba1dd%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAEYi1X_J4o_4sQYgD9A-zU0REzSCoTE7nRx-hYQDNUPrtSdgcQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

3

Thanks.
I must be missing the meaning of this setting.
I tried both "*" and "*YYYY.MM.DD" and still don't get any matching indices.

On Monday, 27 April 2015 13:04:51 UTC+10, Mark Walkom wrote:

You cannot use wild card prefixes.

There is functionally no difference between * and *-something, as each
index has to be checked to see if it matches, so you might as well just use
*.

On 27 April 2015 at 12:19, Amos S <amos.s...@gmail.com <javascript:>>
wrote:

Hi,
I'm installing Kibana 4.0.0 on Linux x86, using ES 1.5.0 as a back end.
All data in ES is fed through logstash but there is no common prefix like
"logstash-*".
All indices are daily based, e.g. "analytics-2015.04.25".

On Kibana's initia settings page I do:

  1. Check on the "Index contains time-based events"
  2. Check OFF the "Use event times to create index names"
  3. Put the following in the pattern field: "[*-]YYYY.MM.DD"

But the button below the pattern field is grayed out and says "Unable to
fetch mapping. Do you have indices matching the pattern?".
Here is a screenshot:

https://lh3.googleusercontent.com/-G12Fj-SnUmQ/VT2bnbiAPyI/AAAAAAAAO1I/Um5kAYDcY0A/s1600/Screen%2BShot%2B2015-04-27%2Bat%2B12.14.16%2Bpm.png
If I tick on the "Use event times to create index names" then I get
"Pattern matches 0% of existing indices and aliases":

https://lh3.googleusercontent.com/-hcG6sXH8L_c/VT2cLo283TI/AAAAAAAAO1Q/sYWGRiWlMN0/s1600/Screen%2BShot%2B2015-04-27%2Bat%2B12.16.58%2Bpm.png

  1. What am I doing wrong?
  2. Do I have to check the "Use event times to create index names" ON or
    OFF?
  3. (bonus question): Is there a static file which contains these
    settings? Eventually I intend to configure this using Puppet if possible.

Thanks.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/c65c16e6-1f98-4105-8096-8bd69e8ba1dd%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/c65c16e6-1f98-4105-8096-8bd69e8ba1dd%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/2835d505-f5c2-43dc-9150-fb3a9d5d1686%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.