# Kibana No results found **URL:** \ **Category:** Elasticsearch\ **Created:** [January 2, 2018, 4:46pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811 "2018-01-02T16:46:58Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![E\_Marshall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e_marshall/32/14191_2.png) [@E\_Marshall](https://discuss.elastic.co/u/E_Marshall)\ **Post date:** [January 2, 2018, 4:46pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/1 "2018-01-02T16:46:58Z")
I'm assuming that my problem with Kibana yielding 'No results found' when I try to visualize the data may be due to the way I created my template mapping. "mappings": { "_default_":{ "\_all":{ "enabled": false } "dynamic": false }, "event":{ "properties":{ "logLevel":{ "type": "keyword" }, "logMessage":{ "type": "text" }, "logLineNumber":{ "type": "integer" } } } } My question are Do I need to have the _default_ specified? Is it because I'm creating "event" that Kibana does not see the data when creating the visualization? Co-worker suggests that I define the index to be used as "event" for the settings but I don't know how, or where this would even be set. Also, I created in the template the use of an alias which I'm thinking I can remove all together. And does the template value need to match up to the index value specified on the PUT call? I cannot share a screenshot because the systems do not connect to the outside world. ---
**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\ **Post date:** [January 2, 2018, 4:49pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/2 "2018-01-02T16:49:45Z")
With `dynamic` set to false and no date fields defined in your mapping, Kibana might not be able to see your documents indeed. ---
**Author:** ![E\_Marshall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e_marshall/32/14191_2.png) [@E\_Marshall](https://discuss.elastic.co/u/E_Marshall)\ **Post date:** [January 2, 2018, 4:51pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/3 "2018-01-02T16:51:22Z")
Kibana does see the data under the Discover page. In the Visualize page only the count appears to be visible. ---
**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\ **Post date:** [January 2, 2018, 5:39pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/4 "2018-01-02T17:39:09Z")
How does your index pattern look like? Which numeric field are you using in your visualization? ---
**Author:** ![E\_Marshall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e_marshall/32/14191_2.png) [@E\_Marshall](https://discuss.elastic.co/u/E_Marshall)\ **Post date:** [January 2, 2018, 5:49pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/5 "2018-01-02T17:49:14Z")
I've traced down the issue. I needed to include in my logstash configuration file under the output section a reference to the index, via. index =\> "event" For some reason all of my data was going into an index called "log" which I assume is defaulted. ---
**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\ **Post date:** [January 2, 2018, 5:51pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/6 "2018-01-02T17:51:03Z")
You mean the document type (since this is how your mapping type is named), not the index, i.e. `document_type => "event"` not `index => "event"` ---
**Author:** ![E\_Marshall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e_marshall/32/14191_2.png) [@E\_Marshall](https://discuss.elastic.co/u/E_Marshall)\ **Post date:** [January 2, 2018, 5:53pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/7 "2018-01-02T17:53:38Z")
Thank you for the information, I was still doing it incorrectly. I'll change it to document\_type =\> "event" So being that it is a template mapping, I don't have to specify the index ? ---
**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\ **Post date:** [January 2, 2018, 5:55pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/8 "2018-01-02T17:55:14Z")
By default, the index name will be `logstash-yyyy.MM.dd` but you can definitely change it to whatever you like/need/want. ---
**Author:** ![E\_Marshall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e_marshall/32/14191_2.png) [@E\_Marshall](https://discuss.elastic.co/u/E_Marshall)\ **Post date:** [January 2, 2018, 5:58pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/9 "2018-01-02T17:58:39Z")
Val, I appreciate your help. I've been stumbling through all of this. I do have index specified. I'll restart the stuff and see what happens. ---
**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\ **Post date:** [January 2, 2018, 6:02pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/10 "2018-01-02T18:02:01Z")
Note, however, that if you change the index name, you might need to (re-)create the index pattern to match the new index name. And if you do, your saved searches and visualization might need to be updated as well. ---
**Author:** ![E\_Marshall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e_marshall/32/14191_2.png) [@E\_Marshall](https://discuss.elastic.co/u/E_Marshall)\ **Post date:** [January 2, 2018, 6:13pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/11 "2018-01-02T18:13:35Z")
Yeah, reading up on how to move indexes is on my things to do list. For now I just deleted the index I had and created a new index with new data to keep moving forward. Nothing has really worked in regards to the visualization so I'm not concerned with that at the moment either. ---
**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\ **Post date:** [January 2, 2018, 6:18pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/12 "2018-01-02T18:18:49Z")
Cool, feel free to chime in if you have other questions. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 30, 2018, 6:19pm UTC](https://discuss.elastic.co/t/kibana-no-results-found/113811/13 "2018-01-30T18:19:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.