Kibana is not creating Index even the index is present in Elasticsearch

[vnaresh666666 (naresh)]

I have created an index from logstash on my linux machine which i can see at :9200/_cat/indices?v. but when i want to create the same index in kibana, It is detecting the index but when i click on create nothing is happening.

I don't have x-pack installed with kibana. i am just running kibana without any authentication.

Don't go on the name of index(tomcatlog1-index1). it just named like that

See attachment

[timroes]

Hi,

that seems weird. The name also seems right, since apparently Kibana was able to load the field list (otherwise the @timestamp) shouldn't be shown.

Could you try refreshing the page and retest it. If it still not works, could you open your browsers developer tools (Windows/Linux, usually: F12 or Ctrl+Shift+i, Mac: CMD+Option+i) and check whether there is any output in the "Console"?

Cheers
Tim

[vnaresh666666 (naresh)]

Yes, I did. It is showing forbidden when i click on create button.
Actually I am having two indices. One created by root user and other is by user. I have tried staring the kibana service with root and user with both indices vice versa. Still, not able to create the index.

I could able to ping to Elasticsearch host.

one more is i am using Elasticsearch, logstash and kibana of version 6.0.0-rc1
PFA

[timroes]

In general it isn't very recommended to run Elasticsearch with security and Kibana without. It may cause weird behaviors.

In general if you do so, you must make sure that you are now using the correct user, that has permissions to the .kibana index (or permissions to create this index if it doesn't exists yet).

[deepybee (Dan Palmer-Bancel)]

So you can hit 9200 with a GET from your browser, but not from the Kibana host with a POST.

In the absence of X-Pack Security the 403 is very odd and indicates a possible issue with a third party intermediary somewhere. Are you perhaps connecting over an HTTP proxy?

If you open Dev Tools in Kibana what happens when you enter

PUT a_test_index

DELETE a_test_index

POST a_test_index/doc/1 { "foo": "bar" }

GET a_test_index/_search

in that order?

My suspicion is a proxy somewhere preventing POST requests but allowing GET requests. If Console (Dev Tools) can send GET requests successfully but not some or all of PUT, POST, DELETE we know that communication between Kibana and Elasticsearch is possible but that something somewhere is blocking non GET requests.

After trying the above you can re-run DELETE a_test_index to restore the initial state.

[deepybee (Dan Palmer-Bancel)]

@timroes

In general it isn't very recommended to run Elasticsearch with security and Kibana without.

Ah - missed that entirely. Yes that could cause strange behaviour.

[vnaresh666666 (naresh)]

Even I am not using any security for Elasticsearch. I have created a user other than root and with that user i am starting elasticsearch service.