Kibana isn't seeing/loading indexes after upgrade


(Jeremy C) #1

Upgraded from 5.6.2 to 6.1.2. I did the manual kibana re-indexing so now I have a ".kibana-6" index. I verified it exists with _cat/indices.

When I go to Kibana it shows no indexes. Since I know the .kibana-6 index exists, I set my kibana.yml to use that. I can easily add my indexes (logstash-, winlogbeat-, etc) but my concern is all my visualizations and dashboards. Any way to recover them?

Should I go ahead and add my indexes and hope all my visualizations show up?

Thanks


(Chris Roberson) #2

Hi @Jeremy_C,

What do you mean when you say

Where in Kibana are you expecting to see the .kibana index?


(Jeremy C) #3

Sorry if my post was confusing. Kibana says there is no default index. It prompts me to add indexes but when I try to add logstash-* it fails. I don't mind if I need to add logstash-, winlogbeat-, etc but I won't be very happy if my visualizations are all gone.


(Chris Roberson) #4

Gotcha.

Can you post the results of this?

GET .kibana/_mappings


(Jeremy C) #5

{
".kibana-6": {
"mappings": {
"doc": {
"properties": {
"config": {
"properties": {
"buildNum": {
"type": "keyword"
}
}
},
"dashboard": {
"properties": {
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"optionsJSON": {
"type": "text"
},
"panelsJSON": {
"type": "text"
},
"refreshInterval": {
"properties": {
"display": {
"type": "keyword"
},
"pause": {
"type": "boolean"
},
"section": {
"type": "integer"
},
"value": {
"type": "integer"
}
}
},
"timeFrom": {
"type": "keyword"
},
"timeRestore": {
"type": "boolean"
},
"timeTo": {
"type": "keyword"
},
"title": {
"type": "text"
},
"uiStateJSON": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"graph-workspace": {
"properties": {
"description": {
"type": "text"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"numLinks": {
"type": "integer"
},
"numVertices": {
"type": "integer"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
},
"wsState": {
"type": "text"
}
}
},
"index-pattern": {
"properties": {
"fieldFormatMap": {
"type": "text"
},
"fields": {
"type": "text"
},
"intervalName": {
"type": "keyword"
},
"notExpandable": {
"type": "boolean"
},
"sourceFilters": {
"type": "text"
},
"timeFieldName": {
"type": "keyword"
},
"title": {
"type": "text"
}
}
},
"search": {
"properties": {
"columns": {
"type": "keyword"
},
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"sort": {
"type": "keyword"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"server": {
"properties": {
"uuid": {
"type": "keyword"
}
}
},
"timelion-sheet": {
"properties": {
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"timelion_chart_height": {
"type": "integer"
},
"timelion_columns": {
"type": "integer"
},
"timelion_interval": {
"type": "keyword"
},
"timelion_other_interval": {
"type": "keyword"
},
"timelion_rows": {
"type": "integer"
},
"timelion_sheet": {
"type": "text"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"type": {
"type": "keyword"
},
"updated_at": {
"type": "date"
},
"url": {
"properties": {
"accessCount": {
"type": "long"
},
"accessDate": {
"type": "date"
},
"createDate": {
"type": "date"
},
"url": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 2048
}
}
}
}
},
"visualization": {
"properties": {
"description": {
"type": "text"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"savedSearchId": {
"type": "keyword"
},
"title": {
"type": "text"
},
"uiStateJSON": {
"type": "text"
},
"version": {
"type": "integer"
},
"visState": {
"type": "text"
}
}
}
}
}
}
}
}


(Chris Roberson) #6

Can you paste the result of this query?

POST .kibana/_search
{
  "query": {
    "term": {
      "type": {
        "value": "index-pattern"
      }
    }
  }
}

If that returns nothing, can you do this query instead?

POST .kibana/_search

Thanks,
Chris


(Jeremy C) #7

{
"took": 16,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 1,
"max_score": 0.105360515,
"hits": [
{
"_index": ".kibana-6",
"_type": "doc",
"_id": "index-pattern:8fdc5250-fbb6-11e7-817e-55baff81899e",
"_score": 0.105360515,
"_source": {
"type": "index-pattern",
"updated_at": "2018-01-17T18:45:17.428Z",
"index-pattern": {
"title": "logstash-*",
"timeFieldName": "@timestamp"
}
}
}
]
}
}


(Chris Roberson) #8

Do these return anything?

POST .kibana/_search
{
  "query": {
    "term": {
      "type": {
        "value": "visualization"
      }
    }
  }
}
POST .kibana/_search
{
  "query": {
    "term": {
      "type": {
        "value": "dashboard"
      }
    }
  }
}

(Jeremy C) #9

visualization:

{
  "took": 31,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  }
}

dashboard:

{
  "took": 6,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  }
}

I'm guessing that means they're gone.


(Chris Roberson) #10

How did you do this exactly?


(Jeremy C) #11

https://www.elastic.co/guide/en/kibana/current/migrating-6.0-index.html

I'll admit that there is definitely the possibility that I bungled it up.


(Chris Roberson) #12

If you do:

GET _cat/indices

Do you see any other kibana indices?


(Jeremy C) #13

Only ".kibana-6" and a handful of ".monitoring-kibana-6-yyyy.mm.dd".


(Chris Roberson) #14

Yea they definitely aren't there. Do you happen to have any backups? That might be your only option besides recreating them.


(Jeremy C) #15

Yeah, I have everything on tape. I'll just restore back to before.


(Jeremy C) #16

Thank you for all your help. It is appreciated!


(Chris Roberson) #17

Np. Sorry for the inconvenience. Try the upgrade again and lemme know if you have the same issue.


(system) #18

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.