Kibana visualization are down since x-pack installed

Arnaud_Jaspart · December 8, 2017, 6:21pm

Hello,

Problem:
I installed elastic+kibana+logstash 6.0.0, it was working using data imported with LS from mysqldb, I could visualize the data on kibana. I added x-pack on this installation, and then I could not see the graphs even though I could request it from the console.
I don't see any errors in the logs. Sometime I see a error on kibana saying that it cannot find an index.

Steps:

installed ES+KB+LS 6.0.0 from tar.gz : worked great, data from a mysqldb, good viz
installed XP 6.0.0 on ES+KB : could log on, request data from console, but no viz
deleted data from console, recreated data with LS : same
resinstalled ES+KB+XP+LS 6.0.0 from tar.gz : reused LS for mysqldb data, could request, no viz
installed ES+KB+XP+LS 6.0.1 from tar.gz : reimported the data, could request, no viz

Logs:

 [elastic@centos7-db elasticlog]$ ll
 total 668
 -rw-rw-r--. 1 elastic elastic   1519 Dec  8 13:17 elasticsearch_deprecation.log
 -rw-rw-r--. 1 elastic elastic      0 Dec  8 10:44 elasticsearch_index_indexing_slowlog.log
 -rw-rw-r--. 1 elastic elastic      0 Dec  8 10:44 elasticsearch_index_search_slowlog.log
 -rw-rw-r--. 1 elastic elastic   5443 Dec  8 11:16 elasticsearch.log
 -rw-rw-r--. 1 elastic elastic 664153 Dec  8 13:19 kibana.log
 [elastic@centos7-db elasticlog]$ grep -Ri warn .
 ./elasticsearch.log:[2017-12-08T10:44:06,326][WARN ][o.e.b.BootstrapChecks    ] [TyVf39V] max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
 ./elasticsearch.log:[2017-12-08T10:44:06,326][WARN ][o.e.b.BootstrapChecks    ] [TyVf39V] max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
 ./elasticsearch_deprecation.log:[2017-12-08T10:49:55,078][WARN ][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index_patterns]
 ./elasticsearch_deprecation.log:[2017-12-08T10:49:55,099][WARN ][o.e.d.i.m.MapperService  ] [_default_] mapping is deprecated since it is not useful anymore now that indexes cannot have more than one type
 ./elasticsearch_deprecation.log:[2017-12-08T10:50:21,142][WARN ][o.e.d.i.m.UidFieldMapper ] Fielddata access on the _uid field is deprecated, use _id instead
 ./elasticsearch_deprecation.log:[2017-12-08T10:50:25,269][WARN ][o.e.d.i.m.UidFieldMapper ] Fielddata access on the _uid field is deprecated, use _id instead
 ./elasticsearch_deprecation.log:[2017-12-08T11:03:23,691][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
 ./elasticsearch_deprecation.log:[2017-12-08T11:03:23,693][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
 ./elasticsearch_deprecation.log:[2017-12-08T11:03:35,467][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
 ./elasticsearch_deprecation.log:[2017-12-08T11:04:31,009][WARN ][o.e.d.s.a.InternalOrder$Parser] Deprecated aggregation order key [_term] used, replaced by [_key]
 ./elasticsearch_deprecation.log:[2017-12-08T11:21:04,888][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
 ./elasticsearch_deprecation.log:[2017-12-08T11:21:04,897][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
 ./elasticsearch_deprecation.log:[2017-12-08T13:17:10,757][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
 ./elasticsearch_deprecation.log:[2017-12-08T13:17:11,241][WARN ][o.e.d.c.ParseField       ] Deprecated field [inline] used, expected [source] instead
 [elastic@centos7-db elasticlog]$ grep -Ri err .
 ./elasticsearch.log:[2017-12-08T10:44:03,296][INFO ][o.e.n.Node               ] node name [TyVf39V] derived from node ID [TyVf39VJQs-YWyxxESh9gA]; set [node.name] to override
 ./elasticsearch.log:[2017-12-08T10:44:03,296][INFO ][o.e.n.Node               ] JVM arguments [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -XX:+HeapDumpOnOutOfMemoryError, -Des.path.home=/home/elastic/elasticsearch-6.0.1, -Des.path.conf=/home/elastic/elasticsearch-6.0.1/config]

Reverse Proxying:

[root@centos7-db ~]# cat /etc/httpd/conf.d/kibana.conf
ProxyRequests On

ProxyPass /app/kibana http://127.0.0.1:5601/app/kibana
ProxyPassReverse /app/kibana http://127.0.0.1:5601/app/kibana
ProxyPass /app/graph http://127.0.0.1:5601/app/graph
ProxyPassReverse /app/graph http://127.0.0.1:5601/app/graph
ProxyPass /app/ml http://127.0.0.1:5601/app/ml
ProxyPassReverse /app/ml http://127.0.0.1:5601/app/ml
ProxyPass /login http://127.0.0.1:5601/login
ProxyPassReverse /login http://127.0.0.1:5601/login
ProxyPass /logout http://127.0.0.1:5601/logout
ProxyPassReverse /logout http://127.0.0.1:5601/logout
ProxyPass /bundles http://127.0.0.1:5601/bundles
ProxyPassReverse /bundles http://127.0.0.1:5601/bundles
ProxyPass /api http://127.0.0.1:5601/api
ProxyPassReverse /api http://127.0.0.1:5601/api
ProxyPass /api/index_patterns http://127.0.0.1:5601/api/index_patterns
ProxyPassReverse /api/index_patterns http://127.0.0.1:5601/api/index_patterns
ProxyPass /ui http://127.0.0.1:5601/ui
ProxyPassReverse /ui http://127.0.0.1:5601/ui
ProxyPass /plugins http://127.0.0.1:5601/plugins
ProxyPassReverse /plugins http://127.0.0.1:5601/plugins
ProxyPass /app/monitoring http://127.0.0.1:5601/app/monitoring
ProxyPassReverse /app/monitoring http://127.0.0.1:5601/app/monitoring
ProxyPass /app/timelion http://127.0.0.1:5601/app/timelion
ProxyPassReverse /app/timelion http://127.0.0.1:5601/app/timelion


ProxyPass /elasticsearch http://127.0.0.1:9200/
ProxyPassReverse /elasticsearch http://127.0.0.1:9200/

Alias /bundles/ /home/elastic/kibana-6.0.0-linux-x86_64/optimize/bundles/

<Directory /home/elastic/kibana-6.0.0-linux-x86_64>
    Options none
    AllowOverride Limit
.../...
</Directory>

Stacey_Gammon · December 11, 2017, 8:42pm

By "no visualizations" do you mean they aren't showing up in the visualize listing page? Or they aren't showing up when you add them to a dashboard?

Do they show up under Management > Saved Objects?

Where did the visualizations come from? Can they be re-created? Or is it the actual creating of the visualizations that is causing issues?

Arnaud_Jaspart · January 2, 2018, 5:45pm

Hello Stacey,

The timestamp was not compliant as time filter. This is why no data could be shown on the visualization even though the data was there. I could recreate it without time filtering and see the visualization.

Thank you
Best regards
Arnaud

system · January 30, 2018, 5:45pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.