No Results found in Dashboard when adding Visualizations

[lucas.alvarez (Lucas Alvarez Lacasa)]

Hello everybody, a couple of days ago I started a course about Elastic Search, Kibana and Logstash. Everything was working according to plan until I started playing with Visualizations. I defined a simple chart, which works as expected and displays the information that it should.

However, when I try to add that chart on a new dashboard, instead of displaying it, it shows: "No results found.". If I click on the edit button for that visualization added in the dashboard, it directs me to the Visualization page, where it's fully rendered as expected.

Any ideas or solutions for this issue? I also analized the _msearch request done by the browser in both cases, obtaining the following information as the request payload:

1. In visualizations:
   {"index":"cars*","ignore_unavailable":true,"preference":1525280259744}
   {"query":{"query_string":{"analyze_wildcard":true,"query":"*"}},"size":0,"_source":{"excludes":[]},"aggs":{"2":{"terms":{"field":"maker.keyword","size":10,"order":{"_count":"desc"}}}}}

2. In dashboard when displaying visualization created before:
   {"index":"cars*","ignore_unavailable":true,"preference":1525280259744}
   {"query":{"bool":{"must":[{"query_string":{"query":"","analyze_wildcard":true}},{"query_string":{"analyze_wildcard":true,"query":"top"}}],"must_not":[]}},"size":0,"_source":{"excludes":[]},"aggs":{"2":{"terms":{"field":"maker.keyword","size":10,"order":{"_count":"desc"}}}},"version":true,"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"":{"highlight_query":{"bool":{"must":[{"query_string":{"query":"*","analyze_wildcard":true,"all_fields":true}},{"query_string":{"analyze_wildcard":true,"query":"top","all_fields":true}}],"must_not":[]}}}},"fragment_size":2147483647}}

[Brandon_Kobel]

Hey @lucas.alvarez, would you mind including the response from the Dashboard _msearch here as well? Also, would you mind checking the Elasticsearch logs to see if anything interesting is logged there?

[lucas.alvarez (Lucas Alvarez Lacasa)]

Sure @Brandon_Kobel, this is the response for each case:

1. When accessing visualization chart:
   {"responses":[{"took":79,"timed_out":false,"_shards":{"total":5,"successful":5,"failed":0},"hits":{"total":1910114,"max_score":0.0,"hits":[]},"aggregations":{"2":{"doc_count_error_upper_bound":12085,"sum_other_doc_count":406184,"buckets":[{"key":"bmw","doc_count":155337},{"key":"mercedes-benz","doc_count":151944},{"key":"audi","doc_count":147362},{"key":"opel","doc_count":128034},{"key":"ford","doc_count":121588},{"key":"skoda","doc_count":110093},{"key":"volkswagen","doc_count":75030},{"key":"fiat","doc_count":73139},{"key":"citroen","doc_count":63237},{"key":"hyundai","doc_count":39978}]}},"status":200}]}

2. When accessing dashboard on where the chart accessed in step (1) is:
   {"responses":[{"took":13,"timed_out":false,"_shards":{"total":5,"successful":5,"failed":0},"hits":{"total":0,"max_score":0.0,"hits":[]},"aggregations":{"2":{"doc_count_error_upper_bound":0,"sum_other_doc_count":0,"buckets":[]}},"status":200}]}

I'm a total newbie in Elastic, as far as I can tell you, I don't see any weird errors being output in the windows powershell from where I executed elastic search. Should I search somewhere else?

[lucas.alvarez (Lucas Alvarez Lacasa)]

@Brandon_Kobel I was able to fix the issue . Apparently it was caused by the fact that documents were being inserted while I was trying to add visualizations to the dashboard.
I'm assuming this is the reason, since after finishing the process of adding all documents using Logstash it started working.

Thanks and have a good day!.

[Brandon_Kobel]

You should've been able to add Visualizations while documents were still being indexed. Looking at the queries that were executed, did you perhaps have a filter typed into your Dashboard where I've highlighted below? That could have been excluding the documents you expected to see.