New Index not showingup in kibana 5 Discover Data

(Ansuman) #1

Hi Team,

I have loaded sample data given in doc for log data . Could able to successfully do it verified in elasticSearch plugins index got created with data loaded . Create index in kibana but unable to access in "Discover Data" Getting "No Results Found" .

I verified with timestamp format change also still no success .
Can any one help in What am doing wrong?

(Aadarsh Kumayan) #2

check your logs
cat /var/log/logstash/logstash.log
for any errors

(Ansuman) #3

Am not able to run the command can you give the proper command .

(Aadarsh Kumayan) #4

on which system hav you installed your elk server

(Ansuman) #5

Windows 7

(Aadarsh Kumayan) #6

sorry those command were for ubuntu and centos look for windows logs

(Ansuman) #7

How to check for windows logs? BDW from screenshots are you getting any clue. It looks alright to me .

(Christian Dahlqvist) #8

Are your timestamps correctly set in UTC? What do you get if you perform a match all query against the logstash-2017.06.01 index in Console?

(Ansuman) #9

Hi Christian,

Thank you for reaching out, i tried below my screenshots .

getting some parse exception What am i doing wrong ?

(Christian Dahlqvist) #10

I overlooked that you had older indices matching the pattern as well. The console query should look something like this:

GET /logstash-2017.06.01/_search
  "query": {
    "match_all": {}

(Ansuman) #11

Ya christian am able to fetch all data with above command .

(Christian Dahlqvist) #12

Look at the timestamp in your document. I wonder how this ended up in the logstash-2017.06.01 index given that the date is in the future?

(Ansuman) #13

Thanks christian for pointing out but can you conform how future date got set as in my uploaded data json file i checked there is no such date their . And how can i update it .

(Christian Dahlqvist) #14

It is present already in the original message, so I would look at the source of the logs.

(Ansuman) #15

Thanks Christian you save my day . Am new to ES so just playing arround . Please bear with me .:slight_smile:

(system) #16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.