Kibana 7.8.0 auto closed when click on Discover

[nameisnotimportant]

Hi All,

I am using ELK 7.8.0.
I have been inserting data into elasticsearch using logstash.
Today, i loaded more data with different date format setting in the config file, i am not able to open Discover. Either Discover auto closed and revert to whatever page i was previously browsing, or it will load but prompt me error message:

"undefined" is not a configured index pattern ID

Showing the default index pattern:
"ml_usrip" (f248d7b0-cb25-11ea-ab4a-

my config file setting:

input {
file {
path => "C:/ELK7.8/logstash-7.8.0/data/ML/*.csv"
start_position => "beginning"
sincedb_path => "NUL"
}
}

filter {
csv {
columns => ["logindate","userid","ipaddress","browsertype"]
}
date {
match => ["logindate","yyyy-MM-dd'T'HH:mm:ss.SSS'Z'",
"yyyy-MM-dd'T'HH:mm:ss.SSSS'Z'"]
timezone => "Asia/Kuala_Lumpur"
target => "@timestamp"
}
}

output{
elasticsearch {
hosts => "localhost:9200"
index => "ml_ei"
}
stdout {
codec => rubydebug
}
}

May i know how could i troubleshoot this problem?

[lukeelmers]

Hi @nameisnotimportant -

Today, i loaded more data with different date format setting in the config file,

Are you bringing in a new column with a different date format, or adding data with different date formatting to an existing field?

In Kibana, does @timestamp show as being date in your index pattern?

If there are any errors from your browser console that you could share here, that might also help pinpoint what's going on.

[nameisnotimportant]

Hi lukeelmers,

I didn’t bring in new column. When I inspect my data, I noticed that some of the test data were created with 4 digits of decimal fraction, some with 3 digits of decimal fraction. So, I added the new date format in the config file.

Original:

date {
match => ["logindate","yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"]
timezone => "Asia/Kuala_Lumpur"
target => " @timestamp "
}
}

New:

date {
match => ["logindate","yyyy-MM-dd'T'HH:mm:ss.SSS'Z'",
"yyyy-MM-dd'T'HH:mm:ss.SSSS'Z'"]
timezone => "Asia/Kuala_Lumpur"
target => " @timestamp "
}
}

@timestamp shown as date in my index pattern.

The error message of => “undefined” is not a configured index pattern ID…...
is the only error message I got.

Is there any built-in log file that I could look for error message(s)?

By the way, I am using IE 11 as browser. I read that although IE is one of the supported browser, “There will be visual artifacts in IE 11”. Could this be the problem? (ref:Kibana browser support (IE-11)?)

[lukeelmers]

@nameisnotimportant

By the way, I am using IE 11 as browser. I read that although IE is one of the supported browser, “There will be visual artifacts in IE 11”. Could this be the problem?

IE11 is supported until 7.9, but this feels unlikely to be a browser issue -- unless it is working for you in other browsers?

@nameisnotimportant

The error message of => “undefined” is not a configured index pattern ID…...
is the only error message I got.

Is there any built-in log file that I could look for error message(s)?

This sounds like a front-end issue so the browser console is probably the best place to look. Have you confirmed that the index pattern "ml_usrip" (f248d7b0-cb25-11ea-ab4a- is in fact set as "default" in the index patterns UI? Are you able to change to different index patterns in discover using the dropdown?

[nameisnotimportant]

I tried with Chrome and it was working. However, i cannot reproduce the error now as my boss decided to use RHEL as the OS and that problem didn't happen after server OS change to RHEL.