Kibana is failing to find logstash-* indices after shield install

Elastic Stack Kibana
1

I have a kibana (4.3) server and a elasticsearch (2.1) node. I have shield plugin installed on elasticsearch node.

I have a kibana-user defined using the kibana4_user role and on the kibana.yml I have the associated kibana-user and password in place to authinticate.

When I got to my kibana_url:5601 I am getting the following errorl:
Error: [index_not_found_exception] no such index, with: {"index":"[logstash-*]"}

Thoughts?

Best,
Monty

2

In hopes to add some light into what I am working with here are my configs/yml files... In regards to the yml files I will only add what I have added or altered... At the very bottom is my error I am getting...

kibana.yml
server.port: 5601
server.host: "172.24.29.10"
elasticsearch_user: kibana4-user (Using kibana4_server)
elasticsearch_password: password

elasticsearch.yml
cluster.name: name
node.name: name

elasticsearch roles.yml

The required permissions for the kibana 4 server

kibana4_server:
cluster:
- cluster:monitor/nodes/info
- cluster:monitor/health
indices:
'.kibana':
privileges: indices:admin/create, indices:admin/exists, indices:admin/mapping/put, indices:admin/mappings/fields/get, indices:admin/refresh, indices:admin/validate/query, indices:data/read/get, indices:data/read/mget, indices:data/read/search, indices:data/write/delete, indices:data/write/index, indices:data/write/updat

Kibana Error: I have removed my url after http:// in the message

Error: [index_not_found_exception] no such index, with: {"index":"[logstash-*]"}
at respond (http://5601/bundles/kibana.bundle.js:76160:16)
at checkRespForFailure (http://:5601/bundles/kibana.bundle.js:76123:8)
at http://:5601/bundles/kibana.bundle.js:74741:8
at processQueue (http:///bundles/commons.bundle.js:42339:29)
at http://:5601/bundles/commons.bundle.js:42355:28
at Scope.$eval (http://:5601/bundles/commons.bundle.js:43583:29)
at Scope.$digest (http://:5601/bundles/commons.bundle.js:43394:32)
at Scope.$apply (http://:5601/bundles/commons.bundle.js:43691:25)
at done (http://5601/bundles/commons.bundle.js:38140:48)
at completeRequest (http://:5601/bundles/commons.bundle.js:38338:8)

3

After looking at my elasticsearch log file I see the following message:

[INFO ][rest.suppressed ] /logstash-/_mapping/field/ Params: {index=logstash-, allow_no_indices=false, include_defaults=true, _=1450294450960, fields=, ignore_unavailable=false}
[[logstash-*]] IndexNotFoundException[no such index]

I'm also getting this: _mget?timeout=0&ignore_unavailable=true&preference=1450294742366

When I run a curl with /_mget message I am receiving

{"error":{"root_cause":[{"type":"parse_exception","reason":"Failed to derive xcontent"}],"type":"parse_exception","reason":"Failed to derive xcontent"},"status":400}^C
[1]- Done curl -u es_admin:elktest1 http://esearch1.test.utah.edu:9200/_mget?timeout=0
[2]+ Done ignore_unavailable=true

4

I was seeing this in Kibana 4.3.0, but 4.3.1 seems to be fine.

5

You did not provide the config detail for your "kibana4_user" role, or the "users_roles" file to show that the id you use is mapped to the kibana4_users role. It would appear from your error that the role associated with the user you are using does not have access to the "logstash-*" index (your default index, i would assume).
I saw these same errors in 2 instances:
a) when i did not have my id mapped to the "kibana4" role (because i had no access to any indexes)
b) when i mapped my id to a new role (with access only to a specific index), at which point i no longer had access to the default index set in Kibana