Kibana visualizations 7.1.1 no data found

I have upgraded from 6.x to 7.1.1 and my visualizations stopped working. I can see the data but when trying to query on it through discoverer. Through kibana visualizations it does not seem to have access to different terms like Just comes back with no data found. Am I missing something with 7.x?

 @timestamp	May 29, 2019 @ 13:17:33.000
  	t  _id	Ha8ZBWsBbldo96Ox_9QZ
  	t  _index	filebeat-cassandra-log-7.1.1-2019.05.29
	#  _score	 - 
  	t  _type	_doc
   	t  agent.ephemeral_id	9d96c796-a801-4a8b-b386-57c71aef7bc0
   	t  agent.hostname	b-gp2-cassdb2-4
   	t	28082cef-6132-4d92-8a50-34a2abf2b867
   	t  agent.type	filebeat
   	t  agent.version	7.1.1
   	t  ecs.version	1.0.0
   	t	b-gp2-cassdb2-4
   	t  input.type	log
   	t  lineno	054
   	t  log.file.path	/var/log/cassandra/system.log
   	#  log.offset	1,590,973
   	t  program	AntiEntropyStage:1
   	t  statement - [repair #68e265a0-8246-11e9-9b7e-375c2ee0b5fa] Received merkle tree for view_build_status from /
   	t  status	INFO
   	t  tags	cassandra_log, b-gp2-cassdb2-4, beats_input_codec_plain_applied

Hey @kyle_che, did you go through the upgrade procedure outlined here:

I can see the data but when trying to query on it through discoverer

So, Discover is showing you the data you expect?

Through kibana visualizations it does not seem to have access to different terms like

Are you trying to use Visualizations which existed in 6.x, now in 7.1.1 and running into issues; or are you having issues creating new visualizations?

Yes, discoverer is showing the data I expect.

I tried to use the visualizations that were brought over after the upgrade and that did not show any data. I then tried to create a new visualization from scratch but I am getting the same issue. I tried dropping the index pattern and re-creating it but that didn't help either.

If you've deleted the index-pattern which the various Visualizations are associated with, when you go to view the Visualization itself in Visualize, you'll be redirected to the "saved object management" screen:

Are you seeing this behavior? If so, I can walk you through how to address it.

If you're primarily concerned about the ability to create new Visualizations, would you mind posting a screenshot of what you see when you go to create a new visualization?

I'm primarily concerned with the visualization. I'll upload some screenshots. I have the data but it just doesn't seem to want to show via the visualization.

it seems that the beats have different names for the data that comes across. i used to use host.keyword in 6.x and now in 7.x it says i guess i'm going to have to rebuild all of the visualizations unless there is a script that can do that for me. is everyone running into this naming change?

There were a large number of field name changes that Beats introduced in 7.0 It might be worth-while to open up a new discuss issue in the Beats topic to see if they have any advice for migrating existing visualizations.

ok, thanks

ok, i'm trying to do another visualization and i can see the data in discoverer but not when trying to display in the visualization. see pictures below. will not display anything

never mind .... i ended up deleting my old index patterns and recreating them and i can see the new fields.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.