Visualization works, but not in dashboard


#1

I have a bunch of saved visualizations. I have dashboards that include them. The visualizations used to show up in the dashboards, but now they do not. I recently turned off _all, which I suspect is related. In Discover, or when viewing the visualization, if I put 'source.keyword: "/whereever/G1gc.log"' in the search box then the data shows up. However, when I do this for the Dashboard that contains the same visualization I get nothing.

I am wondering if this is related to the query saved in the kibanaSavedObjectMeta for the visualization, which refers to *, which is not going to get me any data without _all. Any suggestions?


(Shaunak Kashyap) #2

Could you open your browser's Developer Console and check for any errors?


#3

No errors, a couple of INFO messages from kibana.bundle.js and some response time messages from commons.bundle.js


(Shaunak Kashyap) #4

Okay, a couple more follow up questions, please:

  1. Which version of Kibana are you using?

In Discover, or when viewing the visualization, if I put 'source.keyword: "/whereever/G1gc.log"' in the search box then the data shows up.

  1. So no data shows up in Discover if you leave the search box as *? And this was working before you turned off _all in Elasticsearch? If so, when you disabled the _all field in Elasticsearch, did you also setup a index.query.default_field in your index settings, as shown in https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-all-field.html#disabling-all-field?

#5

I think I initially found it in 5.3.1 I think, then 5.3.2. I am now on 5.4.

Correct, * got you no data. The default query field was set to @message, but I delete that field if I parse all the fields out successfully.

I moved the garbage collections stats into their own index, with the default query field being source. I rebuilt the visualization in 5.4 and it now displays correctly in the dashboard with either a blank filter or *, or 'source: "/whereever/G1gc.log"' or "/whereever/G1gc.log"


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.