Kibana 4 showing deleted documents in range views

Elastic Stack Kibana
1

My kibana dashboard is showing documents that I have since deleted..

To reproduce the issue, create an alias that encapsulates the indices that you will be deleting a document type from and assign it to those indices.

Then, after invoking a delete for the type across the alias like:

curl -XDELETE 'eshost:9200/my_alias/my_type_to_delete'

Notice that the type is deleted from the alias'd indices but kibana will still display the documents in it's quick search across whatever time range you have.

Drilling deeper into a specific time range however will result in:

"Courier Fetch: 1 of X shards failed"

The reason provided for the failure in the response (obtained via the developer console in chrome) is: "NullPointerException[null]" for an index that I can confirm no longer has the type that was deleted.

As far as I understand it, Kibana should just be visualizing what's coming from the ES backend so I'm not sure why it would behave this way... please advise.

Edit: my workaround has been to do a "Delete by Query" which I would think should be unnecessary after the first deletion using the alias

Edit 2: it may be worth additionally noting that while deleting by query seems to clean up the problem for specific indices, trying to do the same query-style deletion does not work when using my alias (which I can confirm points to the correct indices)

2

This sounds like a bug report - I'd consider filing it in Github: https://github.com/elastic/kibana/issues

3

I know there is issues with deleting types and using DBQ, so I'd suggest you raise this on the ES area to see what they say.

4

I am facing the same issue. I deleted some documents from elasticsearch indices for specific type, using the
curl -XDELETE http://localhost:9200/logstash*/xyztype

When I query the elasticsearch for the same type it doesnt return any result. The message is:

{
"took" : 166,
"timed_out" : false,
"_shards" : {
"total" : 1035,
"successful" : 1035,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : null,
"hits" : [
]
}
}

But when browsing results in Kibana Discover screen and visualizing by types, that type is still there with many records of that type. I have no idea on whats going on. Also the KOPF plugin is also showing the same count of records that Kibana Discover interface is showing without any filters.

What is wrong is it Elasticsearch or Kibana.? Pls help

5

Please start your own thread.

6

Thread created.