New index patterns are not created

[fuggi]

Hi,
here is the history of issues I've had with ELK the last days:

1. ELK stopped running out of the blue a few days ago showing errors like
   org.elasticsearch.action.NoShardAvailableActionException: No shard available for [get [.kibana][_doc][space:default]: routing [null]]
   or
   org.elasticsearch.action.search.SearchPhaseExecutionException: Search rejected due to missing shards [[.kibana_task_manager_1][0]].
   or
   [2020-08-11T12:53:04,688][DEBUG][o.e.a.s.TransportSearchAction] [django] All shards failed for phase: [query]

2. I restarted ElasticSearch and removed all unassigned shards.

3. I was presented with a "No spaces match search criteria" on the web front-end afterwards:
   

4. So I restarted the ElasticSearch service.

5. Though the ELK stack is running again and the web front-end is accessible, all the index patterns are missing surprisingly. So I tried to create a new index pattern, but basically nothing happened after having selected the time field and hitting the "Create index pattern" button. No error message, no entries in the elasticsearch.log file, no errors in the browser console. Nothing.
   I've cleared the browser cache and removed cookies, but to no avail.
   I've neither found another topic in this forum fitting these circumstances.

Any idea or help would be highly appreciated!

Best regards,
fuggi

[rashmi (kulkarni)]

Index patterns do not create indices, you need to do that in Elasticsearch before Kibana can read them.
GET the mapping from Elasticsearch, edit the mapping, stop kibana, delete .kibana, .kibana_1, .kibana_2 indices, then recreate a new Kibana index. After that it should work when Kibana is started. Note that this will reset all kibana settings though.

Try it out
Thanks
Rashmi

[fuggi]

Hi Rashmi,
thank you for your answer!

Just to avoid misunderstandings: The indexes are existing or rather have been automatically recreated by ElasticSearch as it got new input from Filebeat, but the index patterns were missing and could not be recreated.

Anyways, the resolution was as easy as restarting Kibana. Something I hadn't considered before as I thought it was being restarted "as part" of ElasticSearch. Your advise to "stop kibana" made me aware of it.

Thank you for your valuable input!

Best regards,
Marcus