No matching index found for arcsight-*


(jagdish) #1

HI mates,
i started arcsight module to pull the data and found the index created in kibana with dashboards but none of the dashboards are accessible.When try to open the dashboard i got the error as: no matching index found :no indices match pattern arcsight-*.

please suggest me how to fix this.

Thanks in advance,
jagan


#2

I also icloud need help with this. Need gimp help ASAP.

Regards,
Shane.


(Lewis Barclay) #3

I assume your index is called arcsight-*?


(jagdish) #4

Thanks Lewis,

Yes my index is arcsight-*

Thanks,

jagan


(Lewis Barclay) #5

I've had this issue before, not quite sure why. The solution I have always used is to replace it with the index unique ID instead. In Kibana go to Management > Index Pattern and select the arcsight-* index. Then looking in the URL, copy the part AFTER /indices/ and up to the question mark:

image

Go to your visualization and when it appears with the error, go down to the settings and you will see "arcsight-*" mentioned. Replace it with the UUID you just copied. Save and go back into the visualization and it should be working.


(jagdish) #6

HI Lewis,
As stated by you i tried to find the UUID but i did't find any UUID i got only the following url:http://localhost:5601/app/kibana#/management/kibana/indices/arcsight-*?_g=()&_a=(tab:indexedFields) but no UUID .Could you suggest me how to do that.

Thanks,
Jagan


(Lewis Barclay) #7

Interesting. If you open up the corresponding visualization, not the dashboard, what do you get?


(jagdish) #8

Hi Lewis ,
i got this (plz see the picture

Regards,
jagan


(Lewis Barclay) #9

Do you definitely have data in your index?


(jagdish) #10

No Lewis i don't find any data(document count) when i checked with 'http://localhost:9200/_cat/indices' the indices.
may i know the reason?

Regards,
Jagdish


(Lewis Barclay) #11

Have you setup logstash to ingest data?


(jagdish) #12

no ..i did't setup ingest data


(Lewis Barclay) #13

If you have no data then there is nothing to visualize :slight_smile:


(jagdish) #14

Thanks Lewis,
ll try to ingest data. if i have any issues i ll be back