Multiple issues with Kibana Discover page

First issue is that data stops being displayed in this area at 23:59:59 of the day before even though I know that data is being indexed into the current days Elasticsearch repository by going into the Dev Tools area and running the /_cat/indices search.

Restarting just the Kibana service doesn't work I have to restart all 3 services (Elasticsearch, Kibana, and Logstash) in order for data to start showing up in the Discover page. Even doing that doesn't result in all of the data showing the results are built starting at midnight and get filled in over the span of a few minutes.

This is very frustrating and is having an impact on our ability to quickly respond to and trouble shoot Production issues. Any help or recommendations is greatly appreciated.

Not sure which files to attach to help with this so let me know what would be helpful and I will get them attached.

Bill Youngman

What index pattern are you using in discover? Also, can you post a result of /_cat/indices?


Don't seem to be able to attach my index pattern exports here - how can I get them to you?

Results of /_cat/indices:
health | status | index | uuid |pri | rep | docs.count |docs.deleted | store.size |
yellow | open | responselog-2019.04.17 |fNmrGFoERPmGszy-scvqAg |5 |1 |2635589 | 0 |9.7gb | 9.7gb
yellow |open|requestlogv2-2019.04.17 | EIWF3FN_TMC0U1P13oaI_g | 5 | 1 | 2803228 | 0 | 6.1gb | 6.1gb


looking at how your indices are structured there shouldn't be any problem in displaying them in discover for all the days at the same time.
i assume you have an index pattern something like this: responselog-* and requestlogv2-*.


I haven't done anything to the system but it's been working the past couple of days. I'll continue to monitor but I guess this can be marked as closed - weird.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.