# Unable to save default index pattern - Kibana-7.3

**URL:** <https://discuss.elastic.co/t/unable-to-save-default-index-pattern-kibana-7-3/207774>\
**Category:** Kibana\
**Created:** [November 13, 2019, 8:34pm UTC](https://discuss.elastic.co/t/unable-to-save-default-index-pattern-kibana-7-3/207774 "2019-11-13T20:34:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![deeps](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@deeps](https://discuss.elastic.co/u/deeps)\
**Post date:** [November 13, 2019, 8:34pm UTC](https://discuss.elastic.co/t/unable-to-save-default-index-pattern-kibana-7-3/207774/1 "2019-11-13T20:34:24Z")

</div>

I have an elk stack with basic auth enabled.. meaning I have setup the password for elastic, kibana etc users.

Cluster was in fine state and kibana auth was working fine until I cleared indexes older than 30 days.

After the indexes cleanup, kibana/elastic auth wasn't working.

So i figured by looking at the deleted indexes that the .security index also got deleted.

So I reset the passwords using `/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive` and the auth is working now.

But for some reason, I'm unable to save the index pattern in Kibana.  
Index Management -\> add index pattern -\> type index names -\> select and done.  
Then if I go to Kibana Discover, it again takes me to add index pattern.

Not sure what I'm missing

Please help.

---

<div class="post-metadata">

**Author:** ![deeps](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@deeps](https://discuss.elastic.co/u/deeps)\
**Post date:** [November 13, 2019, 8:37pm UTC](https://discuss.elastic.co/t/unable-to-save-default-index-pattern-kibana-7-3/207774/3 "2019-11-13T20:37:23Z")

</div>

**Kibana error if it helps:**

```
{"type":"log","@timestamp":"2019-11-13T20:34:42Z","tags":["warning","stats-collection"],"pid":22909,"message":"Unable to fetch data from kibana collector"}

{"type":"error","@timestamp":"2019-11-13T20:34:52Z","tags":["warning","stats-collection"],"pid":22909,"level":"error","error":{"message":"[illegal_argument_exception] Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.","name":"Error","stack":"[illegal_argument_exception] Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead. :: {"path":"/.kibana/_search","query":{"ignore_unavailable":true,"filter_path":"aggregations.types.buckets"},"body":"{\"size\":0,\"query\":{\"terms\":{\"type\":[\"dashboard\",\"visualization\",\"search\",\"index-pattern\",\"graph-workspace\",\"timelion-sheet\"]}},\"aggs\":{\"types\":{\"terms\":{\"field\":\"type\",\"size\":6}}}}","statusCode":400,"response":"{\"error\":{\"root_cause\":[{\"type\":\"illegal_argument_exception\",\"reason\":\"Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.\"}],\"type\":\"search_phase_execution_exception\",\"reason\":\"all shards failed\",\"phase\":\"query\",\"grouped\":true,\"failed_shards\":[{\"shard\":0,\"index\":\".kibana\",\"node\":\"lrqL1iQORkmZjgCG1ZXtfQ\",\"reason\":{\"type\":\"illegal_argument_exception\",\"reason\":\"Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.\"}}],\"caused_by\":{\"type\":\"illegal_argument_exception\",\"reason\":\"Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.\",\"caused_by\":{\"type\":\"illegal_argument_exception\",\"reason\":\"Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.\"}}},\"status\":400}"}\n at respond (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:315:15)\n at checkRespForFailure (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:274:7)\n at HttpConnector. (/usr/share/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:166:7)\n at IncomingMessage.wrapper (/usr/share/kibana/node_modules/elasticsearch/node_modules/lodash/lodash.js:4929:19)\n at IncomingMessage.emit (events.js:194:15)\n at endReadableNT (_stream_readable.js:1103:12)\n at process._tickCallback (internal/process/next_tick.js:63:19)"},"message":"[illegal_argument_exception] Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}
```

---

<div class="post-metadata">

**Author:** ![deeps](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@deeps](https://discuss.elastic.co/u/deeps)\
**Post date:** [November 13, 2019, 8:38pm UTC](https://discuss.elastic.co/t/unable-to-save-default-index-pattern-kibana-7-3/207774/4 "2019-11-13T20:38:10Z")

</div>

also seeing

`Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.`

in master node logs

---

<div class="post-metadata">

**Author:** ![deeps](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@deeps](https://discuss.elastic.co/u/deeps)\
**Post date:** [November 14, 2019, 4:12pm UTC](https://discuss.elastic.co/t/unable-to-save-default-index-pattern-kibana-7-3/207774/5 "2019-11-14T16:12:06Z")

</div>

nvm, rebooting kibana instance has fixed everything. closing the issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2019, 4:12pm UTC](https://discuss.elastic.co/t/unable-to-save-default-index-pattern-kibana-7-3/207774/6 "2019-12-12T16:12:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
