kibana 4.5.1 resets the default index

[larsf]

Kibana version: 4.5.1

OS version: RH 6/7, Ubuntu 12

Original install method (e.g. download page, yum, from source, etc.):
from source
Description of the problem including expected versus actual behavior:
If I use curl to change the default index pattern from logstash-* to myIndex-, that works file (see steps below). Retrieving the defaults afterwards verifies this. However as soon as you connect a browser to kibana, it bumps the version number, removes the default string, so it is back to showing logstash- as the default. This worked just fine in 4.4.1 :-)

Steps to reproduce:

1. curl -s -XPUT -H Content-Type: application/json perfnode128:9200/.kibana/config/4.5.1 -d @file, where file contains " {"buildNum":XXXX, "defaultIndex":"myIndex-*"}"
2. retrieving the settings from kibana afterwards shows that it is still there:
   curl -s -XGET 'perfnode128:9200/.kibana/config/4.5.1?v
   retunrs {"_index":".kibana","_type":"config","_id":"4.5.1","_version":1,"found":true,"_source":{"buildNum":XXXX, "defaultIndex":"myIndex-*"}}
3. If you now connect to kibnana with a browser, it will suggest logstash-* as the default index pattern, and if you use curl to see what is confiugration is you get:
   {"_index":".kibana","_type":"config","_id":"4.5.1","_version":2,"found":true,"_source":{"buildNum":XXXX}}

Notice how the version is bumped to 2, and the "defaultIndex" is removed

[Bargs]

@larsf I wasn't able to reproduce following those steps. Are there any other details you can provide?

[larsf]

I am assuming you matched the buildNum to the kibana server you were running .. :-) So are you saying that after doing step 2 and you connected with a browser that kibana presented myIndex-* as the default pattern? Which browser did you use - my test case above was with chrome (osx version)

[Bargs]

So are you saying that after doing step 2 and you connected with a browser that kibana presented myIndex-* as the default pattern?

Yup, the correct default index pattern was preserved. And I used the correct buildNum.

Which browser did you use - my test case above was with chrome (osx version)

Same, Chrome on OSX.

I also tried a few different scenarios, like creating the config object while Kibana is running vs shut down, or when a logstash index does/doesn't exist, but none of that seemed to make a difference.

I'm particularly interested in tracking this down because I've seen it happen when switching between versions of Kibana, but I haven't been able to reproduce it.

[andre-pt]

I was also able to reproduce it, while trying to find a workaround for #7675

In my logstash config I have:

      elasticsearch {
        hosts => ["127.0.0.1:9200"]
        index => "myIndex-%{+YYYY.MM}"
        document_id => "id"
      }

Steps:

1. I have just started a fresh elasticsearch with no data.
2. Started logstash, which created some indexes myIndex-*
3. Connected to Kibana using Chrome in Windows.

At this point Kibana gave me the following error:
Fatal Error
unknown error

Version: 4.5.1
Build: 9892
Error: unknown error
    at respond (http://127.0.0.1:10316/bundles/kibana.bundle.js?v=9892:76380:16)
    at checkRespForFailure (http://127.0.0.1:10316/bundles/kibana.bundle.js?v=9892:76341:8)
    at http://127.0.0.1:10316/bundles/kibana.bundle.js?v=9892:74959:8
    at processQueue (http://127.0.0.1:10316/bundles/commons.bundle.js?v=9892:42360:29)
    at http://127.0.0.1:10316/bundles/commons.bundle.js?v=9892:42376:28
    at Scope.$eval (http://127.0.0.1:10316/bundles/commons.bundle.js?v=9892:43604:29)
    at Scope.$digest (http://127.0.0.1:10316/bundles/commons.bundle.js?v=9892:43415:32)
    at Scope.$apply (http://127.0.0.1:10316/bundles/commons.bundle.js?v=9892:43712:25)
    at done (http://127.0.0.1:10316/bundles/commons.bundle.js?v=9892:38161:48)
    at completeRequest (http://127.0.0.1:10316/bundles/commons.bundle.js?v=9892:38359:8)

I understood it's because Kibana expects logstash-* index and I tried to change it:

$ curl -s -XGET 'localhost:9200/.kibana/config/4.5.1?v'
{"_index":".kibana","_type":"config","_id":"4.5.1","_version":1,"found":true,"_source":{"buildNum":9892}}

$ curl -s -XPUT 'localhost:9200/.kibana/config/4.5.1' -d'{"buildNum":9892, "defaultIndex":"myIndex-*"}'
{"_index":".kibana","_type":"config","_id":"4.5.1","_version":2,"_shards":{"total":2,"successful":1,"failed":0},"created":false}

Kibana refresh

$ curl -s -XPUT 'localhost:9200/.kibana/GET 'localhost:9200/.kibana/config/4.5.1?v'
{"_index":".kibana","_type":"config","_id":"4.5.1","_version":3,"found":true,"_source":{"buildNum":9892}}

After Kibana refresh the defaultIndex disappeared.

[Bargs]

@andre-pt When you updated the .kibana config manually, had you set up the myIndex-* index pattern in the Kibana UI yet? It sounds like you weren't able to access Kibana at all due to the fatal error.

I understood it's because Kibana expects logstash-* index and I tried to change it

Kibana definitely should not error out if logstash-* doesn't exist. I think there was probably some other issue at play. If you can reproduce that error, I'd be interested to know which request in particular errored out (should be able to see in devtools network tab).

[andre-pt]

@Bargs No, it was the first time I was running ES, so the .kibana index didn't exist.

Regarding the kibana error, I have created #7675 I guess it's better to follow up there.

[larsf]

I am still seeing this with 4.5.4. I haven't seen the exception mentioned above yet, but every connection to kibana, removes the setting of defaultIndex and bumps the version

[larsf]

As another datapoint, I did verify that if I set the default index via the kibana UI, the data contained in the .kibana/config/4.5.4 is identical to what I set it to via curl prior to kibana starting. So it is like kibana deciding that it didn't initialize the default index, resets what is in ES and prompts the user. I have tested this with both safari 10.0.1 and chrome 54.0.2840.71, and the behavior is the same

[larsf]

Another datapoint is that, if I have set the default index via the kibana UI, and upgrade kibana (went from 4.5.1 to 4.5.4), it does not reset the defaultIndex. So somewhere it seems like kibana keeps additional state as to wether it assigned the defaultIndex or not (aside from the .kibana/config/4.5.x endpoint)

[larsf]

Got it working by adding the index-pattern before assigning the default index.

Found the solution here : http://stackoverflow.com/questions/36871862/programmatically-set-kibanas-default-index-pattern

Also found that you have to make sure index name used is consistent - for example, this does not work:

curl -XPUT http://:9200/.kibana/index-pattern/myIndex-* -d '{"title" : "MyIndex", "timeFieldName": "timestampFieldNameInYourInputData"}'

curl -XPUT http://:9200/.kibana/config/4.5.0 -d '{"defaultIndex" : "MyIndex"}'

Saw other had used a slightly different url for similar updates like this:

curl -XPUT http://:9200/elasticsearch/.kibana/index-pattern/myIndex-* -d '{"title" : "myIndex-*", "timeFieldName": "timestampFieldNameInYourInputData"}'

Not sure if that gets routed the same way

[timroes]

Closing this due to inactivity. Please reopen if the issue is still relevant.