Kibana's default index pattern get deleted automatically

Hi,

Kibana 6.7.1

I started to face a weird behavior with Kibana, for an unknown reason when logging in to Kibana it complains that there's no default index-pattern configured
I then chose one of the index-pattern from the list and set it as the default, a few minutes later (less than an hour usually), the default index-pattern disappear again.

Looking at the Kibana's setting API (/api/kibana/settings) gives this:
With default index-pattern in place:
{"settings":{"buildNum":{"userValue":20266},"defaultIndex":{"userValue":"3a4c4ba0-9aef-11e8-b6b6-21733e026eb1"},"telemetry:optIn":{"userValue":false},"defaultColumns":{"userValue":["_source"]},"discover:sampleSize":{"userValue":1000},"timelion:es.default_index":{"userValue":"Somecluster:SomeAlias"},"timelion:graphite.url":{"userValue":"http://graphite.domain.com:8080/"},"indexPattern:placeholder":{"userValue":"Virginia:*"},"metaFields":{"userValue":["_source","_index"]},"timelion:showTutorial":{"userValue":false},"state:storeInSessionStorage":{"userValue":true},"search:includeFrozen":{"userValue":true},"timepicker:timeDefaults":{"userValue":"{\n \"from\": \"now-5m\",\n \"to\": \"now\",\n \"mode\": \"quick\"\n}"},"notifications:lifetime:banner":{"userValue":60000}}}

With no default index-pattern in place:
{"settings":{"buildNum":{"userValue":20266},"telemetry:optIn":{"userValue":false},"defaultColumns":{"userValue":["_source"]},"discover:sampleSize":{"userValue":1000},"timelion:es.default_index":{"userValue":"Somecluster:SomeAlias"},"timelion:graphite.url":{"userValue":"http://graphite.domain.com:8080/"},"indexPattern:placeholder":{"userValue":"Virginia:*"},"metaFields":{"userValue":["_source","_index"]},"timelion:showTutorial":{"userValue":false},"state:storeInSessionStorage":{"userValue":true},"search:includeFrozen":{"userValue":true},"timepicker:timeDefaults":{"userValue":"{\n \"from\": \"now-5m\",\n \"to\": \"now\",\n \"mode\": \"quick\"\n}"},"notifications:lifetime:banner":{"userValue":60000}}}

I tried everything to workaround this, i stop all Kibana instances, i restored the '.kibana' index from a snapshot when it was okay for sure, but it keeps happening.
I can tell it was started when one of the index-pattern introduce a huge amount of fields (60k+), i deleted this index-pattern but it didn't help.

What could be the root cause?

Hello,

I'm sorry to hear that! It looks like you have data in your index, so I'm not sure it's related, but here's a similar discuss issue in case it's helpful.

Otherwise, that is a strange issue which some users appear to have encountered though I'm not sure anyone's determined why as of yet. Feel free to comment on this open github issue!

Regards,
Aaron

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.