Unable to create index pattern in kibana 7.2

Elastic Stack Kibana
1

Hi, all
I am trying to make an ELK stack sample after installation of ELK and Filebeat.
But I couldn’t “create an index pattern” in Kibana(version 7.2)
Please let me know what’s wrong in my configuration?
I really appreciate your kind help and assistance before ahead.

Regards,
Bryan

Please refer to my log and config as below.

  1. http://localhost:9200/_cat/indices?v

health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open test 1lU0a11JRe2Bs9GrwBokFA 1 1 0 0 283b 283b
green open kibana_sample_data_ecommerce eNObCUqUQM6M5k67uSXraA 1 0 0 0 283b 283b
yellow open seoul-metro-2014 XvPGIidFTuilKpiU-exncA 1 1 0 0 283b 283b
green open .kibana_task_manager o98jbwBFSLSaIlSKcptBWA 1 0 2 4 74.2kb 74.2kb
green open .kibana_1 iN1f-hqmSTi4V4St_IFeYw 1 0 19 8 52.8kb 52.8kb

Question1 : Why docs.count is zero?

  1. elastic search log

[2019-08-01T15:42:42,572][INFO ][o.e.c.r.a.DiskThresholdMonitor] [MacBook-Pro.local] low disk watermark [85%] exceeded on [ic5dz2_-SpuzfMRaNjTurw][icpsui-MacBook-Pro.local][/elastic-demo/elasticsearch-7.2.0/data/nodes/0] free: 13.5gb[13.3%], replicas will not be assigned to this node
[2019-08-01T15:43:12,603][INFO ][o.e.c.r.a.DiskThresholdMonitor] [MacBook-Pro.local] low disk watermark [85%] exceeded on [ic5dz2_-SpuzfMRaNjTurw][icpsui-MacBook-Pro.local][/elastic-demo/elasticsearch-7.2.0/data/nodes/0] free: 12.5gb[12.3%], replicas will not be assigned to this node
[2019-08-01T15:43:42,634][INFO ][o.e.c.r.a.DiskThresholdMonitor] [MacBook-Pro.local] low disk watermark [85%] exceeded on [ic5dz2_-SpuzfMRaNjTurw][icpsui-MacBook-Pro.local][/elastic-demo/elasticsearch-7.2.0/data/nodes/0] free: 11.2gb[11.1%], replicas will not be assigned to this node
[2019-08-01T15:44:12,651][INFO ][o.e.c.r.a.DiskThresholdMonitor] [MacBook-Pro.local] low disk watermark [85%] exceeded on [ic5dz2_-SpuzfMRaNjTurw][icpsui-MacBook-Pro.local][/elastic-demo/elasticsearch-7.2.0/data/nodes/0] free: 11.2gb[11.1%], replicas will not be assigned to this node
[2019-08-01T15:44:42,721][INFO ][o.e.c.r.a.DiskThresholdMonitor] [MacBook-Pro.local] low disk watermark [85%] exceeded on [ic5dz2_-SpuzfMRaNjTurw][icpsui-MacBook-Pro.local][/elastic-demo/elasticsearch-7.2.0/data/nodes/0] free: 11.2gb[11.1%], replicas will not be assigned to this node
[2019-08-01T15:45:12,762][INFO ][o.e.c.r.a.DiskThresholdMonitor] [MacBook-Pro.local] low disk watermark [85%] exceeded on [ic5dz2_-SpuzfMRaNjTurw][icpsui-MacBook-Pro.local][/elastic-demo/elasticsearch-7.2.0/data/nodes/0] free: 11.2gb[11.1%], replicas will not be assigned to this node
[2019-08-01T15:45:42,795][INFO ][o.e.c.r.a.DiskThresholdMonitor] [MacBook-Pro.local] low disk watermark [85%] exceeded on [ic5dz2_-SpuzfMRaNjTurw][icpsui-MacBook-Pro.local][/elastic-demo/elasticsearch-7.2.0/data/nodes/0] free: 12.2gb[12%], replicas will not be assigned to this node

Question2 : How can I handle the limitation of “the low disk watermark”?

2

  1. First, too low disk space. Elasticsearch does not allocates shards if free disk space is under 15%

  2. If you are creating new dashboards from the beginning, try to erase .kibana_1 index and load kibana again. But it can erase all your past works. so be careful.

3

I really appreciated your soon and kind reply.
I will try to solve this problems according to your guide.
After test, I'd like to share the result in this posting.

4

Hi BS_Lee,

Try to increase the memory of your cluster or delete the unnecessary indices. ES never allows the docs because shards will not distributed as it is having low memory.

Clear the memory or increase it. It will work

5

thanks for your kind information.

6

Thanks to your comments, I could fix these problems.
But I am facing a new problem as below.
Please let me know how to handle it.

[2019-08-06T16:31:48,432][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"seoul-metro-2014", :_type=>"seoul-metro", :routing=>nil}, #LogStash::Event:0x79591b45], :response=>{"index"=>{"_index"=>"seoul-metro-2014", "_type"=>"seoul-metro", "_id"=>"YenXZWwBhpFyamYfV0v1", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [station_geo] of different type, current_type [geo_point], merged_type [ObjectMapper]"}}}}

My configuration is something wrong or the index and its type is not correct?

I truly hope to finish the issues.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.