Kibana unexpectedly changed timeFieldName

Elastic Stack Kibana
1

We've faced with a problem when Kibana unexpectedly changed timeFieldName for a index-pattern. As far as we know no one changed it. But: Was:

-bash-4.1$ curl "http://localhost:9200/.kibana/index-pattern/logstash-*?pretty"
{
  "_index" : ".kibana",
  "_type" : "index-pattern",
  "_id" : "logstash-*",
  "_version" : 2277,
  "found" : true,
  "_source" : {
    "title" : "logstash-*",
    "timeFieldName" : "@timestamp",
    "fields" : "<some>"
  }
}

After some time:

-bash-4.1$ curl "http://localhost:9200/.kibana/index-pattern/logstash-*?pretty"
{
  "_index" : ".kibana",
  "_type" : "index-pattern",
  "_id" : "logstash-*",
  "_version" : 2283,
  "found" : true,
  "_source" : {
    "title" : "logstash-*",
    "timeFieldName" : "received_at",

So the question is - what could cause this changes ? Or how to detect it ?
Thanks in advice.

2

The only way to change the timeFiledName in the Kibana UI is to either; delete the index pattern and recreate it, or create a new index pattern with the same pattern.

Unless you have an application that might be modifying the .kibana index outside of Kibana, or some plugins installed that might be doing this, then someone with access to your Kibana must have made this change.

3

Does Kibana provide any way to catch this changes ? Only verbose logging ?

4

It does not, Kibana does not have a centralized location to store the history for objects yet.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.