Multiple issues with Kibana Discover page


(Bill Youngman) #1

First issue is that data stops being displayed in this area at 23:59:59 of the day before even though I know that data is being indexed into the current days Elasticsearch repository by going into the Dev Tools area and running the /_cat/indices search.

Restarting just the Kibana service doesn't work I have to restart all 3 services (Elasticsearch, Kibana, and Logstash) in order for data to start showing up in the Discover page. Even doing that doesn't result in all of the data showing the results are built starting at midnight and get filled in over the span of a few minutes.

This is very frustrating and is having an impact on our ability to quickly respond to and trouble shoot Production issues. Any help or recommendations is greatly appreciated.

Not sure which files to attach to help with this so let me know what would be helpful and I will get them attached.

Bill Youngman


(Marius Dragomir) #2

What index pattern are you using in discover? Also, can you post a result of /_cat/indices?


(Bill Youngman) #3

Marius,

Don't seem to be able to attach my index pattern exports here - how can I get them to you?

Results of /_cat/indices:
health | status | index | uuid |pri | rep | docs.count |docs.deleted | store.size |pri.store.size
yellow | open | responselog-2019.04.17 |fNmrGFoERPmGszy-scvqAg |5 |1 |2635589 | 0 |9.7gb | 9.7gb
yellow |open|requestlogv2-2019.04.17 | EIWF3FN_TMC0U1P13oaI_g | 5 | 1 | 2803228 | 0 | 6.1gb | 6.1gb

Thanks,
Bill


(Marius Dragomir) #4

looking at how your indices are structured there shouldn't be any problem in displaying them in discover for all the days at the same time.
i assume you have an index pattern something like this: responselog-* and requestlogv2-*.