Underscore in index name makes it invisible for Kibana

[guerda (Philip Gillißen)]

Hi!

I'm using Kibana 6.3.1 on AWS and currently facing the following problem:
I have an index named with an underscore ("_")in the middle. This should be allowed and ElasticSearch let me index and search in it.
Unfortunately, Kibana does not find any index with an underscore in its name.

This blocks me from searching within Kibana or creating any visualization or dashboard, which is a pity.

I haven't found any documentation showing that this is not allowed.
Can anybody explain me what's happening here and if that's intended behavior?

Thanks in advance!

[ppisljar (Peter Pisljar)]

when i try to create index starting with _ i get the following exception from elasticsearch:

{
  "error": {
    "root_cause": [
      {
        "type": "invalid_index_name_exception",
        "reason": "Invalid index name [_test], must not start with '_', '-', or '+'",
        "index_uuid": "_na_",
        "index": "_test"
      }
    ],
    "type": "invalid_index_name_exception",
    "reason": "Invalid index name [_test], must not start with '_', '-', or '+'",
    "index_uuid": "_na_",
    "index": "_test"
  },
  "status": 400
}

seems that docs for 6.3 are still missing this information, but its included in the docs from 6.4 forward:

https://www.elastic.co/guide/en/elasticsearch/reference/6.4/indices-create-index.html

Cannot start with -, _, +

[guerda (Philip Gillißen)]

Hi Peter,

Thank you for your quick reply.

I saw the documentation that a starting underscore is not allowed.

In my case, the underscore is in the middle, which should be allowed. At least elastic search does not complain about that, stores and finds documents in that index.

It's only kibana which does not find the index at all if I try to create a matching index pattern.

In my case it's the index rapid_dev. Even an index pattern like this won't match any index: rapid*

Thanks again for your help!

[ppisljar (Peter Pisljar)]

thats weird, we use underscores in our sample data indexes and it works fine.

is your index status green ?

[ppisljar (Peter Pisljar)]

just tried on my local install, created rapid_dev index and index pattern and hit no issues.

must be something with your AWS instance ?

[guerda (Philip Gillißen)]

The index is green.

It seems to be a complete different issue, I'm sorry for the confusion.
I tried to recreate it but was successful:

>curl -X PUT http://XXX.amazonaws.com/rapid_test
{"acknowledged":true,"shards_acknowledged":true,"index":"rapid_test"}

>curl -H "Content-Type: application/json" -X POST http://XXX.amazonaws.com/rapid_test/_doc/ -d "{ \"a\": \"b\" }"
{"_index":"rapid_test","_type":"_doc","_id":"zQwnZWsB2l6Fkq5Zk5T4","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":0,"_primary_term":1}

>curl -H "Content-Type: application/json" -X GET http://XXX.amazonaws.com/rapid_test/_search
{"took":0,"timed_out":false,"_shards":{"total":5,"successful":5,"skipped":0,"failed":0},"hits":{"total":1,"max_score":1.0,"hits":[{"_index":"rapid_test","_type":"_doc","_id":"zQwnZWsB2l6Fkq5Zk5T4","_score":1.0,"_source":{ "a": "b" }}]}}

Is it because there are currently no documents in the index that Kibana hides it?

[ppisljar (Peter Pisljar)]

possibly, i did add documents when i was testing.

[guerda (Philip Gillißen)]

I did too. Thank you for your help and sorry for the confusion.