Visualization & Dashboard return no results found, while discover tab successfully displays results ?!

[adilld]

Hello everybody,

I have a problem with Kibana: Dashboard and visualizations don't show any results!

As you can see in this screenshot, in the discover tab I get some results! Which means data exists in my index "as-*". right? But I used a trick in order to display this data :

1. I changed the range to "Today" ==> it shows no result found !
2. I clicked "New" button ==> then i get my data displayed!
   Is there an other way "more proper" to get data displayed?

Then in the my dashboard (or visualization) I can't get any results!! even if the range is the same as discover tab!

I restarted Kibana ==> no changes!
I deleted as-* then I created it => no changes!

I'm stuck here ! I ll be glad if you can help me figure it out !
Thank you very much!

[weltenwort (Felix Stürmer)]

Hi @adilld,

that looks like something isn't quite right in Kibana. Could you try to find the _msearch http requests Kibana performs in your browser's network inspector and paste their request bodies for the discover page both without results and after clicking "New"?

[adilld]

Hi @weltenwort
Thank you very much for your reply.
Sorry, but actually I didn't understand 100% of what you said!
Here you can see the _msearch size is different (before clicking on New and after)...

I can't find the request body of the _msearch htttp request.. Where can I found it please?

[weltenwort (Felix Stürmer)]

If you click on each request, a details panel should open containing (among others) a "Headers" tab with a "Request Payload" section:

It could help to diagnose this problem if you could copy the "Request Payload" text for both requests and paste them here.

[adilld]

Thank you ,

Here is the 1st one : (before)

{"index":["as-2017.07.03"],"ignore_unavailable":true,"preference":1499175168023}
{"size":500,"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}}],"query":{"bool":{"must":[{"query_string":{"analyze_wildcard":true,"query":""}},{"range":{"@timestamp":{"gte":1499065200000,"lte":1499076000000,"format":"epoch_millis"}}}],"must_not":[]}},"_source":{"excludes":[]},"aggs":{"2":{"date_histogram":{"field":"@timestamp","interval":"5m","time_zone":"Europe/Berlin","min_doc_count":1}}},"stored_fields":[""],"script_fields":{},"docvalue_fields":["@timestamp"],"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"":{"highlight_query":{"bool":{"must":[{"query_string":{"analyze_wildcard":true,"query":"","all_fields":true}},{"range":{"@timestamp":{"gte":1499065200000,"lte":1499076000000,"format":"epoch_millis"}}}],"must_not":}}}},"fragment_size":2147483647}}

2nd one : (after)

{"index":["as-2017.07.03"],"ignore_unavailable":true,"preference":1499175168023}
{"size":500,"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}}],"_source":{"excludes":},"aggs":{"2":{"date_histogram":{"field":"@timestamp","interval":"5m","time_zone":"Europe/Berlin","min_doc_count":1}}},"query":{"bool":{"must":[{"match_all":{}},{"range":{"@timestamp":{"gte":1499065200000,"lte":1499076000000,"format":"epoch_millis"}}}],"must_not":}},"stored_fields":[""],"script_fields":{},"docvalue_fields":["@timestamp"],"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"":{"highlight_query":{"bool":{"must":[{"match_all":{}},{"range":{"@timestamp":{"gte":1499065200000,"lte":1499076000000,"format":"epoch_millis"}}}],"must_not":}}}},"fragment_size":2147483647}}

Thank you in advance

[weltenwort (Felix Stürmer)]

Thank you for providing that, @adilld.

It seems the first query tries to match the empty string while the second matches everything (as expected):

How do you navigate to that first broken discover view. Are you using some bookmark or link from an external website?

[adilld]

I'm using google chrome as a browser.
To navigate to the discover view I use a direct link "ipServer:port/app/kibana#/discover" !
I tried ipServer:port but same problem... other browsers => same problem...

I can give u some clarifications :

• I'm using a reverse proxy (nginx) but I think the problem is not coming from this one!
• i'm using a searchnode (client). Maybe searchnode doesn't work as expected ?

Thank you @weltenwort

[weltenwort (Felix Stürmer)]

Does the link you are using contain anything like query:(query_string:(analyze_wildcard:!t,query:'')) in the url parameters?

Does the problem also occur if you leave off the #/discover when initially accessing Kibana?

i'm using a searchnode (client). Maybe searchnode doesn't work as expected ?

I do not understand what you mean by "searchnode".

[adilld]

Hello @weltenwort,

Finally I've found the solution of the problem. Actually, On my index pattern, they were a lot of conflicts and that's why Kibana failed to show the vizualisations ..

I deleted all the index, fixed my conf files of Logstash and now it's fine!

Thank you @weltenwort for your help

[weltenwort (Felix Stürmer)]

That is good to know, thank you for reporting back.