Kibana 6.3 has Error 404 / X-Pack-Index not found after upgrade

[creaticious (Lars)]

Hey guys,

today i've upgraded Elastic & Kibana to 6.3. Elastic is working but Kibana shows 404 with:

{"statusCode":404,"error":"Not Found","message":"[index_not_found_exception] no such index, with { resource.type=\"index_expression\" & resource.id=\"_xpack\" & index_uuid=\"_na_\" & index=\"_xpack\" }"}

Any ideas how to create this index or what could have gone wrong during the upgrade?

Thank you!

[Stacey_Gammon]

What version did you upgrade from?

Does the kibana index exist? (if you go to http://localhost:9200/.kibana it should show you the mappings)

Can you supply more output surrounding that error message in the kibana logs? Try with verbose logging turned on as well.

[creaticious (Lars)]

Hi Stacey,

I've upgraded from 6.2. The .kibana-Index is not the problem. As you can see in the last part of the error message above the xpack-Index is missing...but i can't reinstall xpack because the scripts are telling me that xpack now comes with kibana and will not be installed...so what to do...?

Thank you!

[Stacey_Gammon]

That's correct that xpack is now bundled with Kibana.

There is no xpack index. Hmmm, this thread might be relevant: X-Pack installation, does not seem to be creating indices

The new 6.3 installation has license set to basic by default which doesn't include security. Perhaps this is throwing things off? Do you have a license installed? Maybe start a trial license to get security and see if it works?

[creaticious (Lars)]

Thanks, i was able to solve this by adding action.auto_create_index: "*" to the elasticsearch.yml and restarting the kibana.service...

This is something that should have been documented of you are upgrading from 6.2...

[CDuv]

Thanks for the solution, I ran into the exact same issue after upgrading from v6.2.4.

• Added action.auto_create_index: "*" to ElasticSearch's elasticsearch.yml (in my case /etc/elasticsearch/elasticsearch.yml).
• Restarted ElasticSearch.
• Restarted Kibana.
• Accessed Kibana to check it works.
• Removed the line from elasticsearch.yml.
• Restarted ElasticSearch.