Hi,
Kibana 6.7.1
I started to face a weird behavior with Kibana, for an unknown reason when logging in to Kibana it complains that there's no default index-pattern configured
I then chose one of the index-pattern from the list and set it as the default, a few minutes later (less than an hour usually), the default index-pattern disappear again.
Looking at the Kibana's setting API (/api/kibana/settings) gives this:
With default index-pattern in place:
{"settings":{"buildNum":{"userValue":20266},"defaultIndex":{"userValue":"3a4c4ba0-9aef-11e8-b6b6-21733e026eb1"},"telemetry:optIn":{"userValue":false},"defaultColumns":{"userValue":["_source"]},"discover:sampleSize":{"userValue":1000},"timelion:es.default_index":{"userValue":"Somecluster:SomeAlias"},"timelion:graphite.url":{"userValue":"http://graphite.domain.com:8080/"},"indexPattern:placeholder":{"userValue":"Virginia:*"},"metaFields":{"userValue":["_source","_index"]},"timelion:showTutorial":{"userValue":false},"state:storeInSessionStorage":{"userValue":true},"search:includeFrozen":{"userValue":true},"timepicker:timeDefaults":{"userValue":"{\n \"from\": \"now-5m\",\n \"to\": \"now\",\n \"mode\": \"quick\"\n}"},"notifications:lifetime:banner":{"userValue":60000}}}
With no default index-pattern in place:
{"settings":{"buildNum":{"userValue":20266},"telemetry:optIn":{"userValue":false},"defaultColumns":{"userValue":["_source"]},"discover:sampleSize":{"userValue":1000},"timelion:es.default_index":{"userValue":"Somecluster:SomeAlias"},"timelion:graphite.url":{"userValue":"http://graphite.domain.com:8080/"},"indexPattern:placeholder":{"userValue":"Virginia:*"},"metaFields":{"userValue":["_source","_index"]},"timelion:showTutorial":{"userValue":false},"state:storeInSessionStorage":{"userValue":true},"search:includeFrozen":{"userValue":true},"timepicker:timeDefaults":{"userValue":"{\n \"from\": \"now-5m\",\n \"to\": \"now\",\n \"mode\": \"quick\"\n}"},"notifications:lifetime:banner":{"userValue":60000}}}
I tried everything to workaround this, i stop all Kibana instances, i restored the '.kibana' index from a snapshot when it was okay for sure, but it keeps happening.
I can tell it was started when one of the index-pattern introduce a huge amount of fields (60k+), i deleted this index-pattern but it didn't help.
What could be the root cause?