Kibana not allowing to set up indexes

[Ben_Hoffman]

So Kibana gets up and running, but as soon as I type in an index to use, it crashes. The indexes do show up in Elasticsearch, and i can even query then in Kibana before I type in my index.

Kibana starts like normal...

I Can even query data:

I type in the index to use....

It asks if I want to overwrite this even if it is a fresh install!

None of the pages load, and the file names in the URL do not match up with what is really happening.

As you can see from the images above, after I type in an index kibana becomes totally unresponsive.

I have tried the following already:

• Remove the Kibana index from Elasticsearch
• Uninstall and reinstall Kibana

Both change nothing. Anyone have an idea on what to do?

[LeeDr (Lee Drengenberg)]

Can you show what's in the Kibana log? If it's crashing that log would be very useful.

Is Elasticsearch running on the same localhost as Kibana?

After deleting the .kibana index, wait a few seconds for Kibana to realize it's not there and it will re-create it. Then it should only have a small config doc. But you could check that there's no index patterns defined in it with this;

GET .kibana/index-pattern/_search
{
  "query": {
    "match_all": {}
  }
}

You could check the number of docs in the packetbeat-* index in the dev console with;

GET /_cat/indices?v

You could also open the browser dev console and go to the Network tab when you create the index pattern to see what happens there.

Thanks,
Lee

[Ben_Hoffman]

Yes elasticsearch is running on the same host.

Here is what I get from the following curl query:

curl -X GET 'http://localhost:9200/.kibana/index-pattern/_search' -d '
{
  "query": {
    "match_all": {}
  }
}'

Results in :
{"took":1,"timed_out":false,"_shards":{"total":1,"successful":1,"failed":0},"hits":{"total":0,"max_score":null,"hits":[]}}

This query;

   curl -X GET 'http://localhost:9200/_cat/indices?v'

Results in:

health status index                 uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   filebeat-2017.03.02   NAr1w4LCQdKLISVscZulnA   5   1    5632435            0      3.7gb          3.7gb
yellow open   filebeat-2017.03.01   axXtX1Z3QeGc7LwWOZ1HRQ   5   1        464            0    728.3kb        728.3kb
yellow open   packetbeat-2017.03.02 1K8C3KALQKCOMmgW-K_7FA   5   1    6667705            0        2gb            2gb
yellow open   packetbeat-2017.03.03 KPzK8N6TROGNpeVzL_ELMQ   5   1    1780403            0    551.8mb        551.8mb
yellow open   packetbeat-2017.03.01 8BJxXkjGSOeiZXq_LCai8w   5   1       3396            0      1.4mb          1.4mb
yellow open   filebeat-2017.03.03   WvA_F5dIQx-QguXDsx4Y4g   5   1    2779781            0      1.8gb          1.8gb
yellow open   .kibana               ZQLV17IWReqgfTxfB-4UzQ   1   1          1            0      3.1kb          3.1kb

Kibana is running as a service on CentOS, so the logs were not saved due to them being sent to stdout. I just changed to it a log file though, so I will have those soon

[LeeDr (Lee Drengenberg)]

If you don't see logs in /var/log/kibana/ and your CentOS is running systemd, you might find the logs with;
journalctl -u kibana.service

[Ben_Hoffman]

Logs are here on pastebin

[LeeDr (Lee Drengenberg)]

In your logs;
Error: EACCES: permission denied, open '/var/log/kibana.log'

Can you fix that and post some new logs please?

Thanks,
Lee