Unable to set defaultIndex in Kibana

Elastic Stack Kibana
1

I installed ELK 6.3 today. One of my servers was sending metricbeat data to Elasticsearch under the index metricbeat-{date}.

When i login Kibana, it displayed a warning to set defaultIndex. When i created metricbeat-* as defaultIndex, the operation went through, but Kibana reassigned the defaultIndex to null. Got the following error in Console.

Config: config change: defaultIndex: null -> 0e280b30-7a39-11e8-b04b-63fc9d569e6c
Config: config change: defaultIndex: 0e280b30-7a39-11e8-b04b-63fc9d569e6c -> null

/kibana/bundles/vendors.bundle.js:58 TypeError: Cannot read property 'indexPatterns' of undefined
at /kibana/bundles/kibana.bundle.js:68
at Scope.$digest (/kibana/bundles/vendors.bundle.js:58)
at Scope.$apply (/kibana/bundles/vendors.bundle.js:58)
at done (/kibana/bundles/vendors.bundle.js:58)
at completeRequest (/kibana/bundles/vendors.bundle.js:58)
at XMLHttpRequest.xhr.onload (/kibana/bundles/vendors.bundle.js:58)

Even though, i am able to see the indices that are created in Elasticsearch in Kibana, i am unable to create index-patterns. I am not seeing any errors in Kibana and Elasticsearch logs. The only warning in Elasticsearch logs is

[WARN ][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index_patterns]

Any pointers would be highly appreciated.

2

I was able to fix the issue by deleting the .kibana index and re-creating it. Then, i was able to set defaultIndex and view my index-pattern.

Its weird though. All i did was delete .kibana index and restart kibana so it automatically re-creates the .kibana index again. Why it worked now and not while starting kibana the first time is a mystery!

3

I've seen this happen before too. I haven't been able to consistently recreate it though, so I always assumed it was just something weird I was doing. It looks like this issue covers that problem though: https://github.com/elastic/kibana/issues/17230

I've also noticed this issue, which I suspect is related, but I don't have any proof of that: https://github.com/elastic/kibana/issues/15110

4

The mappings for .kibana index while starting kibana initially and after deleting the .kibana index and restarting kiban is different. Why is that?!:confused:

1 Like
5

Kibana-initial

{".kibana":{"mappings":{"doc":{"properties":{"config":{"dynamic":"true","properties":{"buildNum":{"type":"keyword"},"defaultIndex":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}},"dashboard":{"properties":{"description":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"hits":{"type":"long"},"kibanaSavedObjectMeta":{"properties":{"searchSourceJSON":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}},"optionsJSON":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"panelsJSON":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"refreshInterval":{"properties":{"display":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"pause":{"type":"boolean"},"section":{"type":"long"},"value":{"type":"long"}}},"timeFrom":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"timeRestore":{"type":"boolean"},"timeTo":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"title":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"uiStateJSON":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"version":{"type":"long"}}},"index-pattern":{"properties":{"fieldFormatMap":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"fields":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"timeFieldName":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"title":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}},"search":{"properties":{"properties":{"properties":{"hits":{"properties":{"type":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}},"version":{"properties":{"type":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}}}}}},"server":{"properties":{"uuid":{"type":"keyword"}}},"timelion-sheet":{"properties":{"description":{"type":"text"},"hits":{"type":"integer"},"kibanaSavedObjectMeta":{"properties":{"searchSourceJSON":{"type":"text"}}},"timelion_chart_height":{"type":"integer"},"timelion_columns":{"type":"integer"},"timelion_interval":{"type":"keyword"},"timelion_other_interval":{"type":"keyword"},"timelion_rows":{"type":"integer"},"timelion_sheet":{"type":"text"},"title":{"type":"text"},"version":{"type":"integer"}}},"type":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"updated_at":{"type":"date"},"url":{"properties":{"accessCount":{"type":"long"},"accessDate":{"type":"date"},"createDate":{"type":"date"},"url":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":2048}}}}},"visualization":{"properties":{"description":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"kibanaSavedObjectMeta":{"properties":{"searchSourceJSON":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}},"title":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"uiStateJSON":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"version":{"type":"long"},"visState":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}}}}}}}

6

Kibana-restart

{".kibana":{"mappings":{"doc":{"dynamic":"strict","properties":{"config":{"dynamic":"true","properties":{"buildNum":{"type":"keyword"},"defaultIndex":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}},"dashboard":{"properties":{"description":{"type":"text"},"hits":{"type":"integer"},"kibanaSavedObjectMeta":{"properties":{"searchSourceJSON":{"type":"text"}}},"optionsJSON":{"type":"text"},"panelsJSON":{"type":"text"},"refreshInterval":{"properties":{"display":{"type":"keyword"},"pause":{"type":"boolean"},"section":{"type":"integer"},"value":{"type":"integer"}}},"timeFrom":{"type":"keyword"},"timeRestore":{"type":"boolean"},"timeTo":{"type":"keyword"},"title":{"type":"text"},"uiStateJSON":{"type":"text"},"version":{"type":"integer"}}},"index-pattern":{"properties":{"fieldFormatMap":{"type":"text"},"fields":{"type":"text"},"intervalName":{"type":"keyword"},"notExpandable":{"type":"boolean"},"sourceFilters":{"type":"text"},"timeFieldName":{"type":"keyword"},"title":{"type":"text"}}},"search":{"properties":{"columns":{"type":"keyword"},"description":{"type":"text"},"hits":{"type":"integer"},"kibanaSavedObjectMeta":{"properties":{"searchSourceJSON":{"type":"text"}}},"sort":{"type":"keyword"},"title":{"type":"text"},"version":{"type":"integer"}}},"server":{"properties":{"uuid":{"type":"keyword"}}},"timelion-sheet":{"properties":{"description":{"type":"text"},"hits":{"type":"integer"},"kibanaSavedObjectMeta":{"properties":{"searchSourceJSON":{"type":"text"}}},"timelion_chart_height":{"type":"integer"},"timelion_columns":{"type":"integer"},"timelion_interval":{"type":"keyword"},"timelion_other_interval":{"type":"keyword"},"timelion_rows":{"type":"integer"},"timelion_sheet":{"type":"text"},"title":{"type":"text"},"version":{"type":"integer"}}},"type":{"type":"keyword"},"updated_at":{"type":"date"},"url":{"properties":{"accessCount":{"type":"long"},"accessDate":{"type":"date"},"createDate":{"type":"date"},"url":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":2048}}}}},"visualization":{"properties":{"description":{"type":"text"},"kibanaSavedObjectMeta":{"properties":{"searchSourceJSON":{"type":"text"}}},"savedSearchId":{"type":"keyword"},"title":{"type":"text"},"uiStateJSON":{"type":"text"},"version":{"type":"integer"},"visState":{"type":"text"}}}}}}}}

7

I found the reason for the difference in mappings though i dont understand why.

Once Kibana is started, there is no .kibana index in Elasticsearch. I was hoping the .kibana index should be generated when Kibana connects to Elasticsearch on startup.
The .kibana index gets generated only when you perform an operation like creating an index pattern.

We were using Elasticsearch API to add the index-pattern for metricbeat and then add it to default Index. With 6.0 upgrade, Since Kibana API was introduced, we started using that.

curl -XPUT -H "$CONTENT_TYPE" localhost:9200/.kibana/doc/index-pattern:metricbeat -d @$file
curl -XPOST -H "$CONTENT_TYPE" -H "$XSRF" localhost:5601/api/kibana/settings/defaultIndex -d '{"value": "metricbeat-*"}'
This creates a .kibana index which has the wrong mapping

If i use the Kibana API to create index pattern and set the default Index pattern, the .kibana index is generated with proper mapping.

curl -XPOST -H "$CONTENT_TYPE" -H "$XSRF" localhost:5601/api/saved_objects/index-pattern
-d @$file
curl -XPOST -H "$CONTENT_TYPE" -H "$XSRF" localhost:5601/api/kibana/settings/defaultIndex -d '{"value": "metricbeat-*"}'

Why is there a difference? Shouldnt the .kibana index generated from both API's be same?

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.