Kibana blank after deleting index

Elastic Stack Kibana
1

I deleted the filebeat index on accident from kibana browser and now it is coming up blank with a 404 error. I tried to delete the cache, update kibana and es, and reinstall the default templates, but nothing has worked. Any suggestions?

Here is my error:

Request URL:http://server:5601/elasticsearch/packetbeat-*/_mapping/field/*?_=1487601639728&ignore_unavailable=false&allow_no_indices=false&include_defaults=true
Request Method:GET
Status Code:404 Not Found
Remote Address:server:5601

And I cannot just make a dummy index because it is trying to find packetbeat-*

2

Hi @kmrychl,

did you mean that you deleted the packetbeat indices and were those indices set as Kibana's default indices? If so, this sounds like a known problem that occurs when the default index was deleted. Two ways to fix it come to mind:

  1. Delete the defaultIndex key from the Kibana config using a PUT curl request. You should be able to find the settings at ${YOUR_ES_HOST}/.kibana/config/${YOUR_KIBANA_VERSION}.
  2. Create a dummy index matching packetbeat-*, e.g. packetbeat-dummy using curl.
3

I deleted the filebeat, not packetbeat. I want to get back to the filebeat default.
Can you also give the exact commands to follow. I'm new to this and I'm not sure how to delete the default index or create a dummy to match a pattern

it also looks like filebeat is not receiving anything..

 curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'
{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 0,
    "successful" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : 0.0,
    "hits" : [ ]
  }
}
4

Ok, so deleting an index should result in Kibana returning a 404 page. What version of Kibana and the Elastic Stack are you running?

5

I'm running 5.2. I am getting a 404 error running kibana.

Failed to load resource: the server responded with a status of 404 (Not Found)

1826×778 13 KB

6

Assuming that an inconsistent state of the default index pattern configuration is the reason, executing the following query should reset it. Replace ${ELASTICSEARCH_HOST} in the URL with the proper value for your Elasticsearch deployment.

curl -XPOST '${ELASTICSEARCH_HOST}/.kibana/_update_by_query?pretty&wait_for_completion&refresh' -H 'Content-Type: application/json' -d'
{
  "script": {
    "inline": "ctx._source.defaultIndex = null",
    "lang": "painless"
  },
  "query": {
    "term": {
      "_type": "config"
    }
  }
}
'

Afterwards you should be able to access the management menu in Kibana to configure the correct default index pattern.

7

ah thank you! This has worked , appreciate the help

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.