Kibana No results found


#1

I'm assuming that my problem with Kibana yielding 'No results found' when I try to visualize the data may be due to the way I created my template mapping.

"mappings": {
"default":{
"_all":{ "enabled": false }
"dynamic": false
},
"event":{
"properties":{
"logLevel":{ "type": "keyword" },
"logMessage":{ "type": "text" },
"logLineNumber":{ "type": "integer" }
}
}
}

My question are
Do I need to have the default specified?
Is it because I'm creating "event" that Kibana does not see the data when creating the visualization?
Co-worker suggests that I define the index to be used as "event" for the settings but I don't know how, or where this would even be set.

Also, I created in the template the use of an alias which I'm thinking I can remove all together.
And does the template value need to match up to the index value specified on the PUT call?

I cannot share a screenshot because the systems do not connect to the outside world.


(Val Crettaz) #2

With dynamic set to false and no date fields defined in your mapping, Kibana might not be able to see your documents indeed.


#3

Kibana does see the data under the Discover page.
In the Visualize page only the count appears to be visible.


(Val Crettaz) #4

How does your index pattern look like?
Which numeric field are you using in your visualization?


#5

I've traced down the issue.
I needed to include in my logstash configuration file under the output section a reference to the index, via. index => "event"

For some reason all of my data was going into an index called "log" which I assume is defaulted.


(Val Crettaz) #6

You mean the document type (since this is how your mapping type is named), not the index, i.e.
document_type => "event"
not
index => "event"


#7

Thank you for the information, I was still doing it incorrectly. I'll change it to document_type => "event"

So being that it is a template mapping, I don't have to specify the index ?


(Val Crettaz) #8

By default, the index name will be logstash-yyyy.MM.dd but you can definitely change it to whatever you like/need/want.


#9

Val, I appreciate your help. I've been stumbling through all of this. I do have index specified. I'll restart the stuff and see what happens.


(Val Crettaz) #10

Note, however, that if you change the index name, you might need to (re-)create the index pattern to match the new index name. And if you do, your saved searches and visualization might need to be updated as well.


#11

Yeah, reading up on how to move indexes is on my things to do list. For now I just deleted the index I had and created a new index with new data to keep moving forward. Nothing has really worked in regards to the visualization so I'm not concerned with that at the moment either.


(Val Crettaz) #12

Cool, feel free to chime in if you have other questions.


(system) #13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.