# Kibana is failing to find logstash-\* indices after shield install **URL:** \ **Category:** Kibana\ **Created:** [December 11, 2015, 9:57pm UTC](https://discuss.elastic.co/t/kibana-is-failing-to-find-logstash-indices-after-shield-install/37019 "2015-12-11T21:57:42Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\ **Post date:** [December 11, 2015, 9:57pm UTC](https://discuss.elastic.co/t/kibana-is-failing-to-find-logstash-indices-after-shield-install/37019/1 "2015-12-11T21:57:42Z")
I have a kibana (4.3) server and a elasticsearch (2.1) node. I have shield plugin installed on elasticsearch node. I have a kibana-user defined using the kibana4\_user role and on the kibana.yml I have the associated kibana-user and password in place to authinticate. When I got to my kibana\_url:5601 I am getting the following errorl: Error: [index\_not\_found\_exception] no such index, with: {"index":"[logstash-\*]"} Thoughts? Best, Monty ---
**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\ **Post date:** [December 16, 2015, 6:07pm UTC](https://discuss.elastic.co/t/kibana-is-failing-to-find-logstash-indices-after-shield-install/37019/2 "2015-12-16T18:07:28Z")
In hopes to add some light into what I am working with here are my configs/yml files... In regards to the yml files I will only add what I have added or altered... At the very bottom is my error I am getting... kibana.yml server.port: 5601 server.host: "172.24.29.10" elasticsearch\_user: kibana4-user (Using kibana4\_server) elasticsearch\_password: password elasticsearch.yml [cluster.name](http://cluster.name): name [node.name](http://node.name): name elasticsearch roles.yml # The required permissions for the kibana 4 server kibana4\_server: cluster: - cluster:monitor/nodes/info - cluster:monitor/health indices: '.kibana': privileges: indices:admin/create, indices:admin/exists, indices:admin/mapping/put, indices:admin/mappings/fields/get, indices:admin/refresh, indices:admin/validate/query, indices:data/read/get, indices:data/read/mget, indices:data/read/search, indices:data/write/delete, indices:data/write/index, indices:data/write/updat Kibana Error: I have removed my url after http:// in the message Error: [index\_not\_found\_exception] no such index, with: {"index":"[logstash-\*]"} at respond ([http://5601/bundles/kibana.bundle.js:76160:16](http://5601/bundles/kibana.bundle.js:76160:16)) at checkRespForFailure (http://:5601/bundles/kibana.bundle.js:76123:8) at http://:5601/bundles/kibana.bundle.js:74741:8 at processQueue (http:///bundles/commons.bundle.js:42339:29) at http://:5601/bundles/commons.bundle.js:42355:28 at Scope.$eval (http://:5601/bundles/commons.bundle.js:43583:29) at Scope.$digest (http://:5601/bundles/commons.bundle.js:43394:32) at Scope.$apply (http://:5601/bundles/commons.bundle.js:43691:25) at done ([http://5601/bundles/commons.bundle.js:38140:48](http://5601/bundles/commons.bundle.js:38140:48)) at completeRequest (http://:5601/bundles/commons.bundle.js:38338:8) ---
**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\ **Post date:** [December 16, 2015, 7:36pm UTC](https://discuss.elastic.co/t/kibana-is-failing-to-find-logstash-indices-after-shield-install/37019/3 "2015-12-16T19:36:01Z")
After looking at my elasticsearch log file I see the following message: [INFO][rest.suppressed] /logstash-_/\_mapping/field/_ Params: {index=logstash-_, allow\_no\_indices=false, include\_defaults=true, \_=1450294450960, fields=_, ignore\_unavailable=false} [[logstash-\*]] IndexNotFoundException[no such index] I'm also getting this: \_mget?timeout=0&ignore\_unavailable=true&preference=1450294742366 When I run a curl with /\_mget message I am receiving {"error":{"root\_cause":[{"type":"parse\_exception","reason":"Failed to derive xcontent"}],"type":"parse\_exception","reason":"Failed to derive xcontent"},"status":400}^C [1]- Done curl -u es\_admin:elktest1 [http://esearch1.test.utah.edu:9200/\_mget?timeout=0](http://esearch1.test.utah.edu:9200/_mget?timeout=0) [2]+ Done ignore\_unavailable=true ---
**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [January 4, 2016, 6:44pm UTC](https://discuss.elastic.co/t/kibana-is-failing-to-find-logstash-indices-after-shield-install/37019/4 "2016-01-04T18:44:37Z")
I was seeing this in Kibana 4.3.0, but 4.3.1 seems to be fine. ---
**Author:** ![ksoucy](https://avatars.discourse-cdn.com/v4/letter/k/dc4da7/32.png) [@ksoucy](https://discuss.elastic.co/u/ksoucy)\ **Post date:** [February 2, 2016, 9:04pm UTC](https://discuss.elastic.co/t/kibana-is-failing-to-find-logstash-indices-after-shield-install/37019/5 "2016-02-02T21:04:48Z")
> [@Kaufusihm](#): > > index=logstash You did not provide the config detail for your "kibana4\_user" role, or the "users\_roles" file to show that the id you use is mapped to the kibana4\_users role. It would appear from your error that the role associated with the user you are using does not have access to the "logstash-\*" index (your default index, i would assume). I saw these same errors in 2 instances: a) when i did not have my id mapped to the "kibana4" role (because i had no access to any indexes) b) when i mapped my id to a new role (with access only to a specific index), at which point i no longer had access to the default index set in Kibana ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:03pm UTC](https://discuss.elastic.co/t/kibana-is-failing-to-find-logstash-indices-after-shield-install/37019/6 "2017-07-06T14:03:33Z")