Not possible to create Index patterns in Kibana

Elastic Stack Kibana
1

I am having issues creating Index patterns in Kibana. When I save the index pattern it first appears in the UI, but as soon as I navigate from the page it disappears. If I query the .kibana index trough the dev tools, I can see that there appears to be a Index pattern created, but Kibana doesn't seem to be able to query it.

I belive that this error message is related to the issue, as I see it right after creating the index pattern:

kibana: {"type":"response","@timestamp":"2019-06-13T08:40:12Z","tags":[],"pid":54858,"method":"get","statusCode":400,"req":{"url":"/api/saved_objects/_find?per_page=20&page=1&fields=title&fields=id&search_fields=title&type=index-pattern&type=visualization&type=dashboard&type=search&sort_field=type&default_search_operator=OR","method":"get","headers":{"host":"[redacted]","x-real-ip":"10.41.88.149","x-forwarded-for":"10.41.88.149","connection":"close","user-agent":"Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate, br","referer":"https://[redacted]/app/kibana","kbn-version":"7.1.1","content-type":"application/json","origin":"https://[redacted]"},"remoteAddress":"10.134.11.11","userAgent":"10.134.11.11","referer":"https://[redacted]/app/kibana"},"res":{"statusCode":400,"responseTime":104,"contentLength":9},"message":"GET /api/saved_objects/_find?per_page=20&page=1&fields=title&fields=id&search_fields=title&type=index-pattern&type=visualization&type=dashboard&type=search&sort_field=type&default_search_operator=OR 400 104ms - 9.0B"}

I also see this message in the Elasticsearch Data nodes at the same time:
[2019-06-13T10:40:12,904][DEBUG][o.e.a.s.TransportSearchAction] [es1-data] All shards failed for phase: [query] org.elasticsearch.ElasticsearchException$1: Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.

Running version 7.1.1 of the ELK stack.

3 Likes
2

@albgus, Have you defined that index in elasticsaerch output and are you getting data in that index? If you have not defined that index pattern in elasticsaerch output plugin in logstash you can't create index pattern over kibana.

You can follow the below document for error set fileddata=true:

document

Thanks.

3

Yes, there are a couple of messages in the index and I can see them by searching manually from the DevTools page.

As for set fielddata=true, the message makes it sound like this is not necessarily a good idea. And if this is actually a requirement for Kibana to work, why would it be disabled by default?

4

So, as I understand it as of now, this is because the ".kibana" index has a mapping for the field [type], which seems to be supposed to of the "keyword" type, but for some reason is a "text" type. If I understand this correctly, it is not possible to change this without reindexing, which is not really possible as .kibana isn't a rolling index so it has to be deleted and recreated with the correct mapping from the beginning.

But i don't know, I think I may be completely lost as that would imply a quite serious bug in Kibana, which should have been caught. Unless there is some really weird setting in my environment.

5

I have set fielddata=true on the type field of the ".kibana" index now, and now I do not get any error when if I query Saved Objects, and there is no Exception in the Elasticsearch logs anymore, so far so good.

Although I can still not use any saved index patterns. Neither through Discover or even see them listed in Saved Objects. I can find the created index pattern object if I query Elasticsearch directly though..

UPDATE: Problem solved!

I did another attempt and instead of setting fielddata=true, set the type of the type field to keyword instead of text, and now it works!

Essentially I had to GET the mapping from Elasticsearch, edit the mapping, stop kibana, delete .kibana, .kibana_1, .kibana_2, then recreate a new Kibana index. After that it works when Kibana is started. Note that this will reset all kibana settings though.

6

Hello,

I'm facing the same issue, (and saw that other users face it too) so I opened an issue on Github for this case :

As we shouldn't have to manually fix the .kibana index :sweat_smile:

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.