Kibana No results found

Elastic Stack Elasticsearch
1

I'm assuming that my problem with Kibana yielding 'No results found' when I try to visualize the data may be due to the way I created my template mapping.

"mappings": {
"default":{
"_all":{ "enabled": false }
"dynamic": false
},
"event":{
"properties":{
"logLevel":{ "type": "keyword" },
"logMessage":{ "type": "text" },
"logLineNumber":{ "type": "integer" }
}
}
}

My question are
Do I need to have the default specified?
Is it because I'm creating "event" that Kibana does not see the data when creating the visualization?
Co-worker suggests that I define the index to be used as "event" for the settings but I don't know how, or where this would even be set.

Also, I created in the template the use of an alias which I'm thinking I can remove all together.
And does the template value need to match up to the index value specified on the PUT call?

I cannot share a screenshot because the systems do not connect to the outside world.

2

With dynamic set to false and no date fields defined in your mapping, Kibana might not be able to see your documents indeed.

3

Kibana does see the data under the Discover page.
In the Visualize page only the count appears to be visible.

4

How does your index pattern look like?
Which numeric field are you using in your visualization?

5

I've traced down the issue.
I needed to include in my logstash configuration file under the output section a reference to the index, via. index => "event"

For some reason all of my data was going into an index called "log" which I assume is defaulted.

6

You mean the document type (since this is how your mapping type is named), not the index, i.e.
document_type => "event"
not
index => "event"

7

Thank you for the information, I was still doing it incorrectly. I'll change it to document_type => "event"

So being that it is a template mapping, I don't have to specify the index ?

8

By default, the index name will be logstash-yyyy.MM.dd but you can definitely change it to whatever you like/need/want.

9

Val, I appreciate your help. I've been stumbling through all of this. I do have index specified. I'll restart the stuff and see what happens.

10

Note, however, that if you change the index name, you might need to (re-)create the index pattern to match the new index name. And if you do, your saved searches and visualization might need to be updated as well.

11

Yeah, reading up on how to move indexes is on my things to do list. For now I just deleted the index I had and created a new index with new data to keep moving forward. Nothing has really worked in regards to the visualization so I'm not concerned with that at the moment either.

12

Cool, feel free to chime in if you have other questions.

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.