Kibana visualizations 7.1.1 no data found

[kyle_che (Kyle Stephenson)]

I have upgraded from 6.x to 7.1.1 and my visualizations stopped working. I can see the data but when trying to query on it through discoverer. Through kibana visualizations it does not seem to have access to different terms like host.name. Just comes back with no data found. Am I missing something with 7.x?

 @timestamp	May 29, 2019 @ 13:17:33.000
  	t  _id	Ha8ZBWsBbldo96Ox_9QZ
  	t  _index	filebeat-cassandra-log-7.1.1-2019.05.29
	#  _score	 - 
  	t  _type	_doc
   	t  agent.ephemeral_id	9d96c796-a801-4a8b-b386-57c71aef7bc0
   	t  agent.hostname	b-gp2-cassdb2-4
   	t  agent.id	28082cef-6132-4d92-8a50-34a2abf2b867
   	t  agent.type	filebeat
   	t  agent.version	7.1.1
   	t  ecs.version	1.0.0
   	t  host.name	b-gp2-cassdb2-4
   	t  input.type	log
   	t  lineno	054
   	t  log.file.path	/var/log/cassandra/system.log
   	#  log.offset	1,590,973
   	t  program	AntiEntropyStage:1
   	t  statement	RepairSession.java:183 - [repair #68e265a0-8246-11e9-9b7e-375c2ee0b5fa] Received merkle tree for view_build_status from /10.124.176.27
   	t  status	INFO
   	t  tags	cassandra_log, b-gp2-cassdb2-4, beats_input_codec_plain_applied

[Brandon_Kobel]

Hey @kyle_che, did you go through the upgrade procedure outlined here: Upgrade Assistant | Kibana User Guide [6.7] | Elastic?

I can see the data but when trying to query on it through discoverer

So, Discover is showing you the data you expect?

Through kibana visualizations it does not seem to have access to different terms like host.name.

Are you trying to use Visualizations which existed in 6.x, now in 7.1.1 and running into issues; or are you having issues creating new visualizations?

[kyle_che (Kyle Stephenson)]

Yes, discoverer is showing the data I expect.

I tried to use the visualizations that were brought over after the upgrade and that did not show any data. I then tried to create a new visualization from scratch but I am getting the same issue. I tried dropping the index pattern and re-creating it but that didn't help either.

[Brandon_Kobel]

If you've deleted the index-pattern which the various Visualizations are associated with, when you go to view the Visualization itself in Visualize, you'll be redirected to the "saved object management" screen:

Are you seeing this behavior? If so, I can walk you through how to address it.

If you're primarily concerned about the ability to create new Visualizations, would you mind posting a screenshot of what you see when you go to create a new visualization?

[kyle_che (Kyle Stephenson)]

I'm primarily concerned with the visualization. I'll upload some screenshots. I have the data but it just doesn't seem to want to show via the visualization.

[kyle_che (Kyle Stephenson)]

it seems that the beats have different names for the data that comes across. i used to use host.keyword in 6.x and now in 7.x it says host.name.keyword. i guess i'm going to have to rebuild all of the visualizations unless there is a script that can do that for me. is everyone running into this naming change?

[Brandon_Kobel]

There were a large number of field name changes that Beats introduced in 7.0 https://www.elastic.co/guide/en/beats/libbeat/master/breaking-changes-7.0.html. It might be worth-while to open up a new discuss issue in the Beats topic to see if they have any advice for migrating existing visualizations.

[kyle_che (Kyle Stephenson)]

ok, thanks

[kyle_che (Kyle Stephenson)]

ok, i'm trying to do another visualization and i can see the data in discoverer but not when trying to display in the visualization. see pictures below.

[kyle_che (Kyle Stephenson)]

host.name will not display anything

[kyle_che (Kyle Stephenson)]

never mind .... i ended up deleting my old index patterns and recreating them and i can see the new fields.