Kibana 6.0.0. RC2 - not creating an index pattern

Elastic Stack Kibana
1

Hi,

I try to store the metricbeat-* index pattern. It can see the fields after I filled that pattern and can choose the @timestamp field. After 1 second of loading, I can click on set as default (with the star). However It is not stored.

When I refresh or go to another page it keeps asking for it.
Is there a way to save it via Dev Tools? Or does someone know the fix?

Thanks in advance.

Greetings,
Peter

2 
GET .kibana/doc/_search
{
  "query": {
    "match": {
      "type": "index-pattern"
    }
  }
}

After I fill in the form I can see the index pattern with that Query; However Kibana just does not see it.
Hope someone knows the solution to this. Looks like, no index-pattern is seen by the FrontEnd.

3

Hi Peter, thanks for posting your question. Could you clarify something for me? Are you saying that when you save the index pattern, it doesn't show up in your list of index patterns of Management > Index Patterns? Or are you saying that it shows up, but setting it as the "Default index" has no effect?

In either case, could you show me a screenshot of what you see under Management > Index Patterns?

Thanks,
CJ

1 Like
4

I created a video for you that is easier.

It is a gif. Please let me know if you want to know more.
The index is not shown / stored in the FrontEnd. However it is created in the .kibana index as shown in the video.

5

Thanks, Peter. This is very strange. I'm assuming you're on Kibana 6.0.0-rc2? I tried to reproduce this but couldn't do so. I just pinged a couple other Kibana engineers to help us out with this. In the meantime, could you tell me if you see any errors in your ES logs?

Thanks,
CJ

6

Hi CJ,

Yeah, I am using Kibana 6.0.0.rc2 all clean install nothing more.
I see no errors in the logs, only in the Google Chrome bundle.js that no index pattern is found.

Let me know if I can help out with access to the Kibana instance.
It is behind IP block but let me know the IP so you can open it.

Greetings Peter

7

It is a clean Ubuntu 16.04 OS, nothing more. I installed it with the .deb installer from the documentation.
Hope you can help out further.

8

Hi @Peter_Steenbergen,

Can you paste the response to this call?

POST .kibana/_search
{
  "size": 10000,
  "from": 0,
  "_source": ["index-pattern.title", "type", "title"],
  "version": true,
  "query": {
    "bool": {
      "filter": [{
        "term": {
          "type": "index-pattern"
        }
      }]
    }
  }
}

and then can you hit the url in the browser and paste the response?

<kibana_instance>/api/saved_objects/?type=index-pattern&fields=title&per_page=10000

Thanks!

1 Like
9

With the first it gives me the response with the new entry. The result was also in the video.
When I open the url it shows the created index (also with the default star).

I finally managed to get it to work.
I removed the whole .kibana index. Then recreated the index and now it is working with creating the index.

I now try to reverse engineer the steps to remake this error.

Base system Ubuntu 16.04, installatie with apt-get.
=> Install ElasticSearch
=> Install Kibana
=> Start / enable ElasticSearch
=> Start / enable Kibana
=> Install Metricbeat
=> Run the ./metricbeat setup --template
=> Run the ./metricbeat setup --dashboards

Now I cant add the template anymore. Removing the .kibana resolved it.

10

Hi @Peter_Steenbergen,

I'm glad you were able to resolve it! I'm not sure the root cause, but I'll do some more digging.

Thanks

11

Hi,

I have the same problem and nothing fix it.
I have two kibana version

  1. 5.6.4 --> work fine
  2. 6.0.0.rc2 --> not creating an index pattern

If you have a step by step how to fix please let me know

12

Hi @wkpv68,

Did you try deleting and recreating your .kibana index? You might want to try ensuring your data is backed up (by using the export feature for saved objects).

I'm still digging into the root cause and will update when I know more.

Thanks

13

Hi,

I think yes
Could you send me the command to delete it?

Thanks

14

Hi @wkpv68,

Try:

DELETE .kibana

Then refresh Kibana and it will auto-create it for you again.

Keep in mind that you might need to export your existing saved objects.

15

@Peter_Steenbergen Can you confirm you're using 6.0.0-rc2 of Metricbeat too?

Those two metricbeat setup steps should create the index pattern for you.

Is there a reported error?

Thanks

16

Just to make there isn't something in the browser's cache from the previous version of Kibana, could you try opening Kibana in a private or incognito browser window or tab. And then try to create an index pattern and see if it is set as the default (if you didn't already have a default index pattern).

Also 6.0.0 is released now!

Thanks,
Lee

17

Yes, both are RC 6.0.0.rc2. But removing the index with: DELETE .kibana worked for me, it was a clean install so it was fine.

Was clean install of ubuntu and Elastic and metric beat and Kibana. With incognito browser.
Will look into v6.0.0. Maybe it is resolved by default with the same steps.

It is fun debugging :smiley:

18

Hi,

Now I got the this error
Error: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];
at http://localhost:5601/bundles/kibana.bundle.js?v=16070:27:28530
at processQueue (http://localhost:5601/bundles/commons.bundle.js?v=16070:39:9912)
at http://localhost:5601/bundles/commons.bundle.js?v=16070:39:10805
at Scope.$digest (http://localhost:5601/bundles/commons.bundle.js?v=16070:39:21741)
at Scope.$apply (http://localhost:5601/bundles/commons.bundle.js?v=16070:39:24520)
at done (http://localhost:5601/bundles/commons.bundle.js?v=16070:38:9495)
at completeRequest (http://localhost:5601/bundles/commons.bundle.js?v=16070:38:13952)
at XMLHttpRequest.xhr.onload (http://localhost:5601/bundles/commons.bundle.js?v=16070:38:14690)

Please advice

19

I'm using couchdb_changes
It is missing in release 6.0 so I add it manually to logstash

20

@Peter_Steenbergen If you can, go ahead and try the 6.0 official release and let us know if things look resolved. We'll keep looking on our end.

Thanks