Visualization & Dashboard return no results found, while discover tab successfully displays results ?!

Elastic Stack Kibana
1

Hello everybody,

I have a problem with Kibana: Dashboard and visualizations don't show any results!

As you can see in this screenshot, in the discover tab I get some results! Which means data exists in my index "as-*". right? But I used a trick in order to display this data :

  1. I changed the range to "Today" ==> it shows no result found !
  2. I clicked "New" button ==> then i get my data displayed!
    Is there an other way "more proper" to get data displayed?

image.png1133×461 250 KB

Then in the my dashboard (or visualization) I can't get any results!! even if the range is the same as discover tab!

image.png1122×632 134 KB

I restarted Kibana ==> no changes!
I deleted as-* then I created it => no changes!

I'm stuck here ! I ll be glad if you can help me figure it out !
Thank you very much!

2

Hi @adilld,

that looks like something isn't quite right in Kibana. Could you try to find the _msearch http requests Kibana performs in your browser's network inspector and paste their request bodies for the discover page both without results and after clicking "New"?

1 Like
3

Hi @weltenwort
Thank you very much for your reply.
Sorry, but actually I didn't understand 100% of what you said! :blush:
Here you can see the _msearch size is different (before clicking on New and after)...

I can't find the request body of the _msearch htttp request.. Where can I found it please?

4

If you click on each request, a details panel should open containing (among others) a "Headers" tab with a "Request Payload" section:

image.png1130×475 125 KB

It could help to diagnose this problem if you could copy the "Request Payload" text for both requests and paste them here.

1 Like
5

Thank you ,

Here is the 1st one : (before)

image.png1010×190 12.9 KB

{"index":["as-2017.07.03"],"ignore_unavailable":true,"preference":1499175168023}
{"size":500,"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}}],"query":{"bool":{"must":[{"query_string":{"analyze_wildcard":true,"query":""}},{"range":{"@timestamp":{"gte":1499065200000,"lte":1499076000000,"format":"epoch_millis"}}}],"must_not":[]}},"_source":{"excludes":[]},"aggs":{"2":{"date_histogram":{"field":"@timestamp","interval":"5m","time_zone":"Europe/Berlin","min_doc_count":1}}},"stored_fields":[""],"script_fields":{},"docvalue_fields":["@timestamp"],"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"":{"highlight_query":{"bool":{"must":[{"query_string":{"analyze_wildcard":true,"query":"","all_fields":true}},{"range":{"@timestamp":{"gte":1499065200000,"lte":1499076000000,"format":"epoch_millis"}}}],"must_not":}}}},"fragment_size":2147483647}}

2nd one : (after)

image.png996×186 8.11 KB

{"index":["as-2017.07.03"],"ignore_unavailable":true,"preference":1499175168023}
{"size":500,"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}}],"_source":{"excludes":},"aggs":{"2":{"date_histogram":{"field":"@timestamp","interval":"5m","time_zone":"Europe/Berlin","min_doc_count":1}}},"query":{"bool":{"must":[{"match_all":{}},{"range":{"@timestamp":{"gte":1499065200000,"lte":1499076000000,"format":"epoch_millis"}}}],"must_not":}},"stored_fields":[""],"script_fields":{},"docvalue_fields":["@timestamp"],"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"":{"highlight_query":{"bool":{"must":[{"match_all":{}},{"range":{"@timestamp":{"gte":1499065200000,"lte":1499076000000,"format":"epoch_millis"}}}],"must_not":}}}},"fragment_size":2147483647}}

Thank you in advance

6

Thank you for providing that, @adilld.

It seems the first query tries to match the empty string while the second matches everything (as expected):

image.png1247×344 33.2 KB

How do you navigate to that first broken discover view. Are you using some bookmark or link from an external website?

1 Like
7

I'm using google chrome as a browser.
To navigate to the discover view I use a direct link "ipServer:port/app/kibana#/discover" !
I tried ipServer:port but same problem... other browsers => same problem...

I can give u some clarifications :

  • I'm using a reverse proxy (nginx) but I think the problem is not coming from this one!
  • i'm using a searchnode (client). Maybe searchnode doesn't work as expected ?

Thank you @weltenwort

8

Does the link you are using contain anything like query:(query_string:(analyze_wildcard:!t,query:'')) in the url parameters?

Does the problem also occur if you leave off the #/discover when initially accessing Kibana?

i'm using a searchnode (client). Maybe searchnode doesn't work as expected ?

I do not understand what you mean by "searchnode".

9

Hello @weltenwort,

Finally I've found the solution of the problem. Actually, On my index pattern, they were a lot of conflicts and that's why Kibana failed to show the vizualisations ..

I deleted all the index, fixed my conf files of Logstash and now it's fine!

Thank you @weltenwort for your help

1 Like
10

That is good to know, thank you for reporting back.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.