Kibana graph now showing on a selected Index

[Kevin_f]

Hi All,

I have got an issue where a particular index is not showing the graph like other indexes do within discovery. This index I am referring to is for the ingestion of Cloudtrail logs not showing the bar graph as it should do like shown in the diagram below:

Is there a way to set the graph for this index? I would have thought it comes by default but in this case it is not.

Help would be much appreciated. Many thanks.

[defalt]

For reference what does the other index look like in discover?

[Kevin_f]

Hi @defalt,

Thank you for your response. The index that is not showing the graph is just blank at the top as shown:

[defalt]

Just a stupid question and I am pretty sure you checked it but did you chose the right timescale and does your index contain data? If there is no data it should be blank.

[Kevin_f]

yes timescale is set to date like the others and yes index is ingesting data

[defalt]

Did you set a timefield? What does the index "mapping" look like in kibana? Anything unusual there?

[Kevin_f]

yeah this is what I got for the index

However I dont get to see the little blue time icon next to the @timestamp

And mapping shows:

[defalt]

@Kevin_f

However I dont get to see the little blue time icon next to the @timestamp

I think thats were the problem is. Maybe create a new Index pattern and select the @timestamp as your timefield.

[Kevin_f]

hmmm...ideally we want to try and avoid that as this is a production environment and require to use the same index name.

This index pattern timefield was already set as @timestamp

Is there any other way to fix this?

[defalt]

A new index pattern just for testing shouldn't be a problem with your production environment. Its just so we can check if thats actually the problem or if its something else.

[Kevin_f]

ahh bravo that seemed to work. Definitely something wrong with the old index

I was hoping to refresh the index name in Management > Kibana index but no joy. Very strange

[defalt]

Can't you change your production environment for a new index pattern? This would solve it as it works with this new pattern.

[Kevin_f]

Yeah i guess we have no other choice really. Thank you so much for your help defalt