Kibana isn't seeing/loading indexes after upgrade

Elastic Stack Kibana
1

Upgraded from 5.6.2 to 6.1.2. I did the manual kibana re-indexing so now I have a ".kibana-6" index. I verified it exists with _cat/indices.

When I go to Kibana it shows no indexes. Since I know the .kibana-6 index exists, I set my kibana.yml to use that. I can easily add my indexes (logstash-, winlogbeat-, etc) but my concern is all my visualizations and dashboards. Any way to recover them?

Should I go ahead and add my indexes and hope all my visualizations show up?

Thanks

2

Hi @Jeremy_C,

What do you mean when you say

Where in Kibana are you expecting to see the .kibana index?

3

Sorry if my post was confusing. Kibana says there is no default index. It prompts me to add indexes but when I try to add logstash-* it fails. I don't mind if I need to add logstash-, winlogbeat-, etc but I won't be very happy if my visualizations are all gone.

4

Gotcha.

Can you post the results of this?

GET .kibana/_mappings

5

{
".kibana-6": {
"mappings": {
"doc": {
"properties": {
"config": {
"properties": {
"buildNum": {
"type": "keyword"
}
}
},
"dashboard": {
"properties": {
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"optionsJSON": {
"type": "text"
},
"panelsJSON": {
"type": "text"
},
"refreshInterval": {
"properties": {
"display": {
"type": "keyword"
},
"pause": {
"type": "boolean"
},
"section": {
"type": "integer"
},
"value": {
"type": "integer"
}
}
},
"timeFrom": {
"type": "keyword"
},
"timeRestore": {
"type": "boolean"
},
"timeTo": {
"type": "keyword"
},
"title": {
"type": "text"
},
"uiStateJSON": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"graph-workspace": {
"properties": {
"description": {
"type": "text"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"numLinks": {
"type": "integer"
},
"numVertices": {
"type": "integer"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
},
"wsState": {
"type": "text"
}
}
},
"index-pattern": {
"properties": {
"fieldFormatMap": {
"type": "text"
},
"fields": {
"type": "text"
},
"intervalName": {
"type": "keyword"
},
"notExpandable": {
"type": "boolean"
},
"sourceFilters": {
"type": "text"
},
"timeFieldName": {
"type": "keyword"
},
"title": {
"type": "text"
}
}
},
"search": {
"properties": {
"columns": {
"type": "keyword"
},
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"sort": {
"type": "keyword"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"server": {
"properties": {
"uuid": {
"type": "keyword"
}
}
},
"timelion-sheet": {
"properties": {
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"timelion_chart_height": {
"type": "integer"
},
"timelion_columns": {
"type": "integer"
},
"timelion_interval": {
"type": "keyword"
},
"timelion_other_interval": {
"type": "keyword"
},
"timelion_rows": {
"type": "integer"
},
"timelion_sheet": {
"type": "text"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"type": {
"type": "keyword"
},
"updated_at": {
"type": "date"
},
"url": {
"properties": {
"accessCount": {
"type": "long"
},
"accessDate": {
"type": "date"
},
"createDate": {
"type": "date"
},
"url": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 2048
}
}
}
}
},
"visualization": {
"properties": {
"description": {
"type": "text"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"savedSearchId": {
"type": "keyword"
},
"title": {
"type": "text"
},
"uiStateJSON": {
"type": "text"
},
"version": {
"type": "integer"
},
"visState": {
"type": "text"
}
}
}
}
}
}
}
}

6

Can you paste the result of this query?

POST .kibana/_search
{
  "query": {
    "term": {
      "type": {
        "value": "index-pattern"
      }
    }
  }
}

If that returns nothing, can you do this query instead?

POST .kibana/_search

Thanks,
Chris

7

{
"took": 16,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 1,
"max_score": 0.105360515,
"hits": [
{
"_index": ".kibana-6",
"_type": "doc",
"_id": "index-pattern:8fdc5250-fbb6-11e7-817e-55baff81899e",
"_score": 0.105360515,
"_source": {
"type": "index-pattern",
"updated_at": "2018-01-17T18:45:17.428Z",
"index-pattern": {
"title": "logstash-*",
"timeFieldName": "@timestamp"
}
}
}
]
}
}

8

Do these return anything?

POST .kibana/_search
{
  "query": {
    "term": {
      "type": {
        "value": "visualization"
      }
    }
  }
}

POST .kibana/_search
{
  "query": {
    "term": {
      "type": {
        "value": "dashboard"
      }
    }
  }
}
9

visualization:

{
  "took": 31,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  }
}

dashboard:

{
  "took": 6,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  }
}

I'm guessing that means they're gone.

10

How did you do this exactly?

11

https://www.elastic.co/guide/en/kibana/current/migrating-6.0-index.html

I'll admit that there is definitely the possibility that I bungled it up.

12

If you do:

GET _cat/indices

Do you see any other kibana indices?

13

Only ".kibana-6" and a handful of ".monitoring-kibana-6-yyyy.mm.dd".

14

Yea they definitely aren't there. Do you happen to have any backups? That might be your only option besides recreating them.

15

Yeah, I have everything on tape. I'll just restore back to before.

16

Thank you for all your help. It is appreciated!

17

Np. Sorry for the inconvenience. Try the upgrade again and lemme know if you have the same issue.

18

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.