No matching index found for arcsight-*

(jagdish) #1

HI mates,
i started arcsight module to pull the data and found the index created in kibana with dashboards but none of the dashboards are accessible.When try to open the dashboard i got the error as: no matching index found :no indices match pattern arcsight-*.

please suggest me how to fix this.

Thanks in advance,


I also icloud need help with this. Need gimp help ASAP.


(Lewis Barclay) #3

I assume your index is called arcsight-*?

(jagdish) #4

Thanks Lewis,

Yes my index is arcsight-*



(Lewis Barclay) #5

I've had this issue before, not quite sure why. The solution I have always used is to replace it with the index unique ID instead. In Kibana go to Management > Index Pattern and select the arcsight-* index. Then looking in the URL, copy the part AFTER /indices/ and up to the question mark:


Go to your visualization and when it appears with the error, go down to the settings and you will see "arcsight-*" mentioned. Replace it with the UUID you just copied. Save and go back into the visualization and it should be working.

(jagdish) #6

HI Lewis,
As stated by you i tried to find the UUID but i did't find any UUID i got only the following url:http://localhost:5601/app/kibana#/management/kibana/indices/arcsight-*?_g=()&_a=(tab:indexedFields) but no UUID .Could you suggest me how to do that.


(Lewis Barclay) #7

Interesting. If you open up the corresponding visualization, not the dashboard, what do you get?

(jagdish) #8

Hi Lewis ,
i got this (plz see the picture


(Lewis Barclay) #9

Do you definitely have data in your index?

(jagdish) #10

No Lewis i don't find any data(document count) when i checked with 'http://localhost:9200/_cat/indices' the indices.
may i know the reason?


(Lewis Barclay) #11

Have you setup logstash to ingest data?

(jagdish) #12

no ..i did't setup ingest data

(Lewis Barclay) #13

If you have no data then there is nothing to visualize :slight_smile:

(jagdish) #14

Thanks Lewis,
ll try to ingest data. if i have any issues i ll be back

(system) closed #15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.