I have 100+ indices with 40+ GB of daily data matched to single kibana index pattern.
When I open discover tab (no filters, last 6months) i get "No results".
However, recreating the same query with curl I get all the data I expected. Furthermore, deleting (and recreating) the kibana index pattern with the same ID (temporary) solves the problem. I'm able to see the data after recreating pattern, but after logout it's "no results" again.
Where can I locate the error or warning, of where can I look for trouble?
The issues started appearing after upgrade to 7.1.1. (and switch to SSL/authentification). Also it's only issue for a single kibana index pattern, other 10+ are OK.
Can you use the Inspector in the Discover page and compare the request/response when you get the error and when you get the results?
Also, are there any errors displayed in the ES or Kibana logs when that query fails?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.