Visualization works, but not in dashboard

[Badger]

I have a bunch of saved visualizations. I have dashboards that include them. The visualizations used to show up in the dashboards, but now they do not. I recently turned off _all, which I suspect is related. In Discover, or when viewing the visualization, if I put 'source.keyword: "/whereever/G1gc.log"' in the search box then the data shows up. However, when I do this for the Dashboard that contains the same visualization I get nothing.

I am wondering if this is related to the query saved in the kibanaSavedObjectMeta for the visualization, which refers to *, which is not going to get me any data without _all. Any suggestions?

[shaunak (Shaunak Kashyap)]

Could you open your browser's Developer Console and check for any errors?

[Badger]

No errors, a couple of INFO messages from kibana.bundle.js and some response time messages from commons.bundle.js

[shaunak (Shaunak Kashyap)]

Okay, a couple more follow up questions, please:

1. Which version of Kibana are you using?

In Discover, or when viewing the visualization, if I put 'source.keyword: "/whereever/G1gc.log"' in the search box then the data shows up.

2. So no data shows up in Discover if you leave the search box as *? And this was working before you turned off _all in Elasticsearch? If so, when you disabled the _all field in Elasticsearch, did you also setup a index.query.default_field in your index settings, as shown in Mapping | Elasticsearch Guide [8.11] | Elastic?

[Badger]

I think I initially found it in 5.3.1 I think, then 5.3.2. I am now on 5.4.

Correct, * got you no data. The default query field was set to @message, but I delete that field if I parse all the fields out successfully.

I moved the garbage collections stats into their own index, with the default query field being source. I rebuilt the visualization in 5.4 and it now displays correctly in the dashboard with either a blank filter or *, or 'source: "/whereever/G1gc.log"' or "/whereever/G1gc.log"