Logstash index failed to create

Elastic Stack Elasticsearch
1

Hello,

I seen the problem when debug elasticsearch:

[2015-07-20 16:09:18,291][INFO ][node ] [Unseen] started
[2015-07-20 16:09:18,324][INFO ][gateway ] [Unseen] recovered [2] indices into cluster_state
[2015-07-20 16:09:18,885][INFO ][cluster.service ] [Unseen] added {[logstash-vmvnsyslog02.kefico.hkmg.global-4104-11624][p4LoJymPSkqUi75XPCD1KA][vmvnsyslog02.kefico.hkmg.global][inet[/10.126.122.27:9300]]{client=true, data=false},}, reason: zen-disco-receive(join from node[[logstash-vmvnsyslog02.kefico.hkmg.global-4104-11624][p4LoJymPSkqUi75XPCD1KA][vmvnsyslog02.kefico.hkmg.global][inet[/10.126.122.27:9300]]{client=true, data=false}])
[2015-07-20 16:10:17,305][DEBUG][action.admin.indices.create] [Unseen] [logstash-] failed to create
org.elasticsearch.indices.InvalidIndexNameException: [logstash-] Invalid index name [logstash-*], must not contain the following characters [, /, *, ?, ", <, >, |, , ,]
at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService.validateIndexName(MetaDataCreateIndexService.java:166)
at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService.validate(MetaDataCreateIndexService.java:551)
at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService.access$200(MetaDataCreateIndexService.java:88)
at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService$2.execute(MetaDataCreateIndexService.java:230)
at org.elasticsearch.cluster.service.InternalClusterService$UpdateTask.run(InternalClusterService.java:374)
at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:188)
at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:158)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)

And on Kibana website appeared the message:"Kibana: Unable to create Kibana index "logstash-*"
I installed ELK on CentOS 6.6 final via repo with the lastest ELK version.
Do i missing any configuration?

Best regards,

1217×614 46.8 KB

2

Did you set kibana_index in the kibana.yml file to logstash-*?

This is not the place to set the index pattern for Kibana. This settings changes the name of the index that Kibana uses to store dashboards and internal state. You will need to revert this change and restart both Elasticsearch and Kibana. Setting the index pattern for Kibana can be done by following the instructions in this link: https://www.elastic.co/guide/en/kibana/current/settings.html#set-default-pattern

4

Hello,

I still problem even set set kibana_index in the kibana.yml file to logstash-* and restarted Elasticsearch and Kibana.

Here is my kibana.yml file:

    # Kibana is served by a back end server. This controls which port to use.
port: 5601

# The host to bind the server to.
#host: "0.0.0.0"

host: "localhost"

# The Elasticsearch instance to use for all your queries.
elasticsearch_url: "http://localhost:9200"

# preserve_elasticsearch_host true will send the hostname specified in `elasticsearch`. If you set it to false,
# then the host you use to connect to *this* Kibana instance will be sent.
elasticsearch_preserve_host: true

# Kibana uses an index in Elasticsearch to store saved searches, visualizations
# and dashboards. It will create a new index if it doesn't already exist.
#kibana_index: ".kibana"
kibana_index: "logstash-*"

# If your Elasticsearch is protected with basic auth, this is the user credentials
# used by the Kibana server to perform maintence on the kibana_index at statup. Your Kibana
# users will still need to authenticate with Elasticsearch (which is proxied thorugh
# the Kibana server)
# kibana_elasticsearch_username: user
# kibana_elasticsearch_password: pass

# If your Elasticsearch requires client certificate and key
# kibana_elasticsearch_client_crt: /path/to/your/client.crt
# kibana_elasticsearch_client_key: /path/to/your/client.key

# If you need to provide a CA certificate for your Elasticsarech instance, put
# the path of the pem file here.
# ca: /path/to/your/CA.pem

# The default application to load.
default_app_id: "discover"

# Time in milliseconds to wait for elasticsearch to respond to pings, defaults to
# request_timeout setting
# ping_timeout: 1500

# Time in milliseconds to wait for responses from the back end or elasticsearch.
# This must be > 0
request_timeout: 300000

# Time in milliseconds for Elasticsearch to wait for responses from shards.
# Set to 0 to disable.
shard_timeout: 0

# Time in milliseconds to wait for Elasticsearch at Kibana startup before retrying
# startup_timeout: 5000

# Set to false to have a complete disregard for the validity of the SSL
# certificate.
verify_ssl: true

# SSL for outgoing requests from the Kibana Server (PEM formatted)
# ssl_key_file: /path/to/your/server.key
# ssl_cert_file: /path/to/your/server.crt

# Set the path to where you would like the process id file to be created.
# pid_file: /var/run/kibana.pid

# If you would like to send the log output to a file you can set the path below.
# This will also turn off the STDOUT log output.
# log_file: ./kibana.log

# Plugins that are included in the build, and no longer found in the plugins/ folder
bundled_plugin_ids:
 - plugins/dashboard/index
 - plugins/discover/index
 - plugins/doc/index
 - plugins/kibana/index
 - plugins/markdown_vis/index
 - plugins/metric_vis/index
 - plugins/settings/index
 - plugins/table_vis/index
 - plugins/vis_types/index
 - plugins/visualize/index

One more when i testing ELK by http://localhost:9200/_aliases?pretty
It's showing:

{
  ".kibana" : {
    "aliases" : {}
   },
   "tutorial" : {
    "aliases" : {}

  }

}

Any help is appreciated,

Best regards,

5

The 'kibana_index' parameter in kibana.yml specifies, as Colin stated, which internal index Kibana will use to store its configuration and data. You should leave this set to '.kibana' and not change it to the index pattern you are looking to view. You will need to specify the log stash index pattern under 'Settings' in Kibana as per the link Colin provided. This can not be specified in the kibana.yml file.

6

As I said before, this is the problem. Remove this line and restart Elasticsearch and Kibana and the problem should be resolved.

7

Hello,

After leave the 'kibana_index' to '.kibana' i can see the kibana webpage, but do not have Create button.

kibana.PNG1286×616 30.6 KB

Do i misconfiguration file?

Best regards,