# There was an error retrieving the index pattern

**URL:** https://discuss.elastic.co/t/there-was-an-error-retrieving-the-index-pattern/218610
**Category:** Synthetics
**Created:** [February 10, 2020, 2:44pm UTC](https://discuss.elastic.co/t/there-was-an-error-retrieving-the-index-pattern/218610 "2020-02-10T14:44:48Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![OrangeDog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orangedog/32/4630_2.png) [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)
#### Post date: [February 10, 2020, 2:44pm UTC](https://discuss.elastic.co/t/there-was-an-error-retrieving-the-index-pattern/218610/1 "2020-02-10T14:44:48Z")

</div>

Continuing [[7.5] There was an error retrieving the index pattern](https://discuss.elastic.co/t/7-5-there-was-an-error-retrieving-the-index-pattern/210742)

I had the same issue and tried removing the `xpack.security.enabled: false` setting. However, then kibana failed to complete startup; serving "Kibana server is not ready yet" with nothing in the logs.

Then when I put the config back and restarted kibana again, elasticsearch (on the same server) was OOM killed. Having resolved that, Kibana still didn't work, and making another request appears to have DoSed the whole machine (whether through CPU load or OOM or both I'm not yet sure). After a reboot it all seems to be working again (though the original issue remains).

So in summary, I had the same (minor) problem, and trying the suggested fix made it considerably worse.

---

<div class="post-metadata">

### Author: ![jek5104](https://avatars.discourse-cdn.com/v4/letter/j/91b2a8/32.png) [@jek5104](https://discuss.elastic.co/u/jek5104)
#### Post date: [February 11, 2020, 2:07pm UTC](https://discuss.elastic.co/t/there-was-an-error-retrieving-the-index-pattern/218610/2 "2020-02-11T14:07:37Z")

</div>

Hi @OrangeDog - do you have an explicit setting for `xpack.security.enabled` in your ElasticSearch config? Also, what license are you running?

Do you have other data streams coming to ES from sources besides Heartbeat?

---

<div class="post-metadata">

### Author: ![OrangeDog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orangedog/32/4630_2.png) [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)
#### Post date: [February 11, 2020, 3:52pm UTC](https://discuss.elastic.co/t/there-was-an-error-retrieving-the-index-pattern/218610/3 "2020-02-11T15:52:27Z")

</div>

> do you have an explicit setting for `xpack.security.enabled` in your Elasticsearch config

Yes. That's also set to `false`.

> what license are you running?

Basic

> Do you have other data streams coming to ES

Logstash and APM

---

<div class="post-metadata">

### Author: ![OrangeDog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orangedog/32/4630_2.png) [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)
#### Post date: [February 12, 2020, 10:34am UTC](https://discuss.elastic.co/t/there-was-an-error-retrieving-the-index-pattern/218610/4 "2020-02-12T10:34:10Z")

</div>

Having just upgraded everything to Elastic 7.6, the issue appears to be resolved.

---

<div class="post-metadata">

### Author: ![jek5104](https://avatars.discourse-cdn.com/v4/letter/j/91b2a8/32.png) [@jek5104](https://discuss.elastic.co/u/jek5104)
#### Post date: [February 12, 2020, 2:01pm UTC](https://discuss.elastic.co/t/there-was-an-error-retrieving-the-index-pattern/218610/5 "2020-02-12T14:01:58Z")

</div>

I was going to mention that the problem would likely go away with an upgrade to 7.6, but I didn't want that to be the default solution I recommended.

Glad the issue has been resolved for you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 7, 2020, 2:02pm UTC](https://discuss.elastic.co/t/there-was-an-error-retrieving-the-index-pattern/218610/6 "2020-03-07T14:02:04Z")

</div>

This topic was automatically closed 24 days after the last reply. New replies are no longer allowed.
