Diagnosing Kibana Lens Visualization Rendering Failures in Elastic Stack 8.x

Recognizable Condition

When opening a Lens visualization in Kibana you see a blank canvas or the message “No data to display” even though the underlying index contains recent documents.

Cause/Diagnostic Table

Ordered Checks

1. Confirm the visualization ID: open the Lens visualization, copy the ID from the URL (e.g., visualization:id) or from the saved object list.
2. Verify the index pattern:
   1. Navigate to Stack Management → Index Patterns.
   2. Search for the pattern used by the visualization (you can see it in the Lens data tab).
   3. If the pattern is missing or renamed, note the exact name.
3. Check user permissions:
   1. Go to Security → Roles and locate the role assigned to the user (e.g., kibana_user).
   2. Ensure the role includes read privileges on the indices that match the pattern (e.g., logs-*).
   3. If the role is missing, add the appropriate index privileges.
4. Inspect the Lens saved object:
   1. Open Dev Tools and run:

   GET .kibana/_doc/

5. Look for the visState and uiState fields. If the JSON is malformed (e.g., missing braces, extra commas) the object is corrupted.
6. If you suspect corruption, do not edit the object directly unless you understand the Lens schema; instead consider recreating the visualization.

Fixes Tied to Findings

• Index pattern mismatch:
  • If the pattern was deleted, recreate it with the same name and appropriate time field.
  • If the pattern was renamed, update the visualization: open the Lens editor, go to the data source, and select the correct pattern.
• Insufficient permissions:
  • Edit the user’s role (or assign a new role) to include read on the target indices.
  • Apply the principle of least privilege: grant access only to the indices needed for the Lens visualization.
• Corrupted saved object:
  • Do not manually edit the JSON unless you are familiar with the Lens saved‑object schema.
  • Instead, export the visualization (if possible) or recreate it from scratch using the same index pattern and fields.
  • If you must edit, make a backup of the object first and validate the JSON with a JSON linter before saving.

Escalation Criteria

• The index pattern exists and the user has correct read privileges, yet the visualization still shows no data.
• The saved object JSON appears valid but Lens fails to render with console errors such as “Cannot read property ‘length’ of undefined”.
• Repeated 403 or 500 responses from Elasticsearch when Lens queries the indices, despite role checks.

In these cases, collect the following before contacting Elastic Support:

• Kibana logs (especially kibana.log) around the time of the failure.
• Elasticsearch audit logs showing the failed requests.
• The full saved object JSON (GET .kibana/_doc/).
• Browser console output (network tab) showing the Lens request and response.