Underscore in index name makes it invisible for Kibana

Elastic Stack Kibana
1

Hi!

I'm using Kibana 6.3.1 on AWS and currently facing the following problem:
I have an index named with an underscore ("_")in the middle. This should be allowed and ElasticSearch let me index and search in it.
Unfortunately, Kibana does not find any index with an underscore in its name.

This blocks me from searching within Kibana or creating any visualization or dashboard, which is a pity.

I haven't found any documentation showing that this is not allowed.
Can anybody explain me what's happening here and if that's intended behavior?

Thanks in advance!

2

when i try to create index starting with _ i get the following exception from elasticsearch:

{
  "error": {
    "root_cause": [
      {
        "type": "invalid_index_name_exception",
        "reason": "Invalid index name [_test], must not start with '_', '-', or '+'",
        "index_uuid": "_na_",
        "index": "_test"
      }
    ],
    "type": "invalid_index_name_exception",
    "reason": "Invalid index name [_test], must not start with '_', '-', or '+'",
    "index_uuid": "_na_",
    "index": "_test"
  },
  "status": 400
}

seems that docs for 6.3 are still missing this information, but its included in the docs from 6.4 forward:

https://www.elastic.co/guide/en/elasticsearch/reference/6.4/indices-create-index.html

Cannot start with -, _, +
1 Like
3

Hi Peter,

Thank you for your quick reply.

I saw the documentation that a starting underscore is not allowed.

In my case, the underscore is in the middle, which should be allowed. At least elastic search does not complain about that, stores and finds documents in that index.

It's only kibana which does not find the index at all if I try to create a matching index pattern.

In my case it's the index rapid_dev. Even an index pattern like this won't match any index: rapid*

Thanks again for your help!

4

thats weird, we use underscores in our sample data indexes and it works fine.

is your index status green ?

1 Like
5

just tried on my local install, created rapid_dev index and index pattern and hit no issues.

must be something with your AWS instance ?

1 Like
6

The index is green.

It seems to be a complete different issue, I'm sorry for the confusion.
I tried to recreate it but was successful:

>curl -X PUT http://XXX.amazonaws.com/rapid_test
{"acknowledged":true,"shards_acknowledged":true,"index":"rapid_test"}

>curl -H "Content-Type: application/json" -X POST http://XXX.amazonaws.com/rapid_test/_doc/ -d "{ \"a\": \"b\" }"
{"_index":"rapid_test","_type":"_doc","_id":"zQwnZWsB2l6Fkq5Zk5T4","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":0,"_primary_term":1}

>curl -H "Content-Type: application/json" -X GET http://XXX.amazonaws.com/rapid_test/_search
{"took":0,"timed_out":false,"_shards":{"total":5,"successful":5,"skipped":0,"failed":0},"hits":{"total":1,"max_score":1.0,"hits":[{"_index":"rapid_test","_type":"_doc","_id":"zQwnZWsB2l6Fkq5Zk5T4","_score":1.0,"_source":{ "a": "b" }}]}}

grafik

Is it because there are currently no documents in the index that Kibana hides it?

7

possibly, i did add documents when i was testing.

8

I did too. Thank you for your help and sorry for the confusion.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.