Kibana Blank Page After Deleting Index

Elastic Stack Kibana
1

I have a blank page for all pages, including the Discovery and Management pages.

I have tried every option in terms of re-indexing, etc that I can find in order to get Kibana to reset. I have many visualizations, etc that I do not want to lose but cannot seem to get Kibana to come back.

Anyone have any ideas?

2

Is it possible that the default index pattern was deleted? If so you could try resetting it as I described in this github comment.

3

It is possible and I think that is what happened.

I tried that suggestion and still a blank page.

I can see from CURL, that documents are still getting indexed and whatnot, I just cannot get Kibana to load.

4 
$ curl -XGET 'http://localhost:9200/_cat/indices?v&s=index'
health status index                          uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .kibana                        f-kBvAucSaq7lHIByFDiUQ   1   0        164           17      419kb          419kb
green  open   .kibana1                       uxnHAkiDQD6jV8dYvWrAqQ   1   0        164            0    167.7kb        167.7kb
5

Would it be possible for you to paste both the Kibana server output and the browser console?

6

I assume that you've run into this issue: https://github.com/elastic/kibana/issues/8373

I suggest either deleting the index pattern via curl or indexing a single doc that matches the old index pattern so you can delete the index pattern and then delete the new index.

7

There isnt any server output from Kibana....the page is just white.

8

Yea, I have a lot of visualizations that I was wanting to keep. That's why I haven't done that yet.

Guess I am doing that now.

9

Does the browser console print any error?

10

Nope.

I have deleted my .kibana index and things seem to be back to semi normal.

I am getting some new errors if I leave the Discover page up for extended periods with 5 minute refresh turned on., Wonder if they are 5.3.0 related.

1 Like
11

Would it be possible for you to post these errors here so we can take a look at them?

12

I will grab a screenshot the next time it happens.

13

That didn't take long.

Kibana Crash 2017-03-30.png1722×939 114 KB

14

The issue still seems to be happening.

This is a relatively new thing. Prior to a few weeks ago. All my logs were collected into the same index. Now I am dividing them up into different indexes.

Could it be the multiple indexes causing the heartache for Kibana?

15

Oh, I did not realize the browser tab was actually crashing. So this looks like an out-of-memory problem in Discover. It's highly unlikely that the multiple indices are the reason. Are the documents you are trying to display particularly big or do they contain fields with large amounts of data?

16

Umm, I am not sure how to answer that.

Forgive my ignorance.

I did select an individual index logstash-ntwk-* and it seems to run just fine.

All my indexes are built with logstash-name-*.

When I use the default index in Kibana, logstash-* is where this crash seems to occur after a few minutes.

17

Don't worry, it's probably me who should asked a more precise question. :wink:

So the fact that it works with a subset of the indices (e.g. logstash-ntwk-*) but not with all indices matching logstash-* suggests that the result set you're receiving when querying logstash-* either hits on a memory leak bug in Kibana or contains large documents. Large documents could either mean

  • documents with a large number of fields (i.e. thousands)
  • documents with large amounts of data in at least one field (e.g. a binary blob representing a large file)

Can you rule out any of the two options?

18

Gotcha...

So, I know for sure, there are not any documents with thousands of fields, individually. But collectively, I think there are about 1400 fields.

The biggest documents would be winlogbeat based. So I doubt that it is those.

19

Thanks for these details. From your previous comments I gather that you are running the freshly released version 5.3.0?

20

I am.

This started happening on 5.2.2 though.