KIBANA INDEX MISTAKE

705 views
Skip to first unread message

Alejandro Martinez

unread,
Mar 11, 2020, 12:24:34 PM3/11/20
to Wazuh mailing list

I need help, please. I tried the following comand to erase the index, but when I start kibana, it creates it again and the same mistake comes up (the mistake is at the bottom).


// curl -XDELETE 'http://localhost:9200/.kibana_task_manager_2' --header "content-type: application/JSON" -u elastic -p




THE MISTAKE I GET:


< Feb 28 14:00:52 srvwaz.com kibana[1058]: {"type":"log","@timestamp":"2020-02-28T14:00:52Z","tags":["info","savedobjects-service"],"pid":1058,"message":"Starting saved objects migrations"}
Feb 28 14:00:52 srvwaz.com kibana[1058]: {"type":"log","@timestamp":"2020-02-28T14:00:52Z","tags":["info","savedobjects-service"],"pid":1058,"message":"Creating index .kibana_task_manager_2."}
Feb 28 14:00:52 srvwaz.com kibana[1058]: {"type":"log","@timestamp":"2020-02-28T14:00:52Z","tags":["warning","savedobjects-service"],"pid":1058,"message":"Unable to connect to Elasticsearch. Error: [resource_already_exists_exception] index [.kibana_task_manager_2/g8bjExgTS1286AKdfmIp8Q] already exists, with { index_uuid="g8bjExgTS1286AKdfmIp8Q" & index=".kibana_task_manager_2" }"}
Feb 28 14:00:52 srvwaz.com kibana[1058]: {"type":"log","@timestamp":"2020-02-28T14:00:52Z","tags":["warning","savedobjects-service"],"pid":1058,"message":"Another Kibana instance appears to be migrating the index. Waiting for that migration to complete. If no other Kibana instance is attempting migrations, you can get past this message by deleting index .kibana_task_manager_2 and restarting Kibana."} />

Alberto Andujar

unread,
Mar 11, 2020, 1:06:16 PM3/11/20
to Wazuh mailing list
Hi Alejandro!

Let's run some commands to get more information: 

Could you tell me which version of the ELK you're using? Have you performed any updates before the error?

Could you check on Elasticsearch how many .kibana_N indices do you have?


run http://localhost:9200/_cat/indices?pretty | grep -i "kibana" on your Elasticsearch server

And also: 

curl -I http://localhost:5601/status

I await your response

Regards,
Alberto 

Alejandro Martinez

unread,
Mar 16, 2020, 4:50:57 AM3/16/20
to Wazuh mailing list
Hello, sorry for not aswering before!!
I haven't updated. My kibana version is 7.6.0 and Elasticsearch is in version 7.6.0


For the second command I get "Connection Refused".

Alberto Andujar

unread,
Mar 18, 2020, 8:05:05 AM3/18/20
to Wazuh mailing list
Hi Alejandro,

Sorry for the delay in response. Could you please try to remove all the indexes and restart kibana?

curl -XDELETE elastic_ip:9200/.kibana_*
curl
-XDELETE elastic_ip:9200/.kibana_task_manager_*
systemctl restart kibana


It's important to know that removing .kibana index will make you lose all your kibana settings (indexes, graphs, dashboards), in case you don't mind losing these Kibana settings do these commands: (otherwise you will have to export saved object, remove the index and import those previous saved objects on the new index).

Best Regards,

Alejandro Martinez

unread,
Mar 18, 2020, 8:12:52 AM3/18/20
to Wazuh mailing list
I deleted all kibana indexes and the same mistake persists.
Reply all
Reply to author
Forward
0 new messages