Resolving 'Index Pattern Not Found' Errors in Kibana Dashboards

The Problem: Broken Dashboard Visualizations

When loading a Kibana dashboard, you may encounter a banner stating "Index Pattern Not Found" or a visualization that fails to render with a missing index error. This happens when a Saved Object (the dashboard or visualization) references a Kibana Index Pattern ID that no longer exists in the Kibana state, even if the raw data still exists in Elasticsearch.

The immediate takeaway: The issue is rarely with the data itself, but with the mapping layer Kibana uses to translate dashboard queries into Elasticsearch requests.

Diagnostic Matrix

Use this table to identify the root cause based on the observed behavior.

Symptom	Elasticsearch Index Status	Kibana Index Pattern Status	Root Cause
Dashboard fails; Index exists in ES	Present	Missing	Pattern was deleted from Stack Management
Dashboard fails; Index missing in ES	Missing	Present/Missing	Data retention policy deleted the indices
Dashboard fails; Pattern renamed	Present	Present (New Name)	Saved Object points to an obsolete ID

Step-by-Step Resolution Path

Step 1: Verify Data Existence

Before fixing the Kibana UI, confirm that the underlying data is still available in the Elasticsearch cluster. Run this command from the Kibana Dev Tools console or via curl from a terminal with cluster admin permissions.

GET /_cat/indices/your-index-name*?v

Expected Result: A list of indices matching your pattern. If the list is empty, your problem is a data loss or retention issue, not a Kibana configuration error.

Step 2: Check Kibana Index Pattern Registry

Navigate to Stack Management > Index Patterns (or Data Views in newer versions). Search for the pattern name referenced in the error message.

• If the pattern is missing: Proceed to Fix A.
• If the pattern exists but has a different name/ID: Proceed to Fix B.

Fix A: Recreating the Missing Pattern

If the indices exist in Elasticsearch but the pattern is gone from Kibana, you must recreate the mapping layer.

1. Go to Stack Management > Index Patterns > Create index pattern.
2. Enter the exact index name or wildcard (e.g., logs-system-*) used by the original dashboard.
3. Select the correct Time field (usually @timestamp).
4. Save the pattern.

Risk: If you select a different time field than the original pattern, time-series visualizations on the dashboard will remain broken.

Fix B: Updating Saved Object References via API

If the index pattern was renamed, the dashboard is still looking for the old ID. Manually updating every visualization is tedious; instead, use the Saved Objects API.

Warning: Back up your Kibana index before performing bulk API updates. Malformed JSON can corrupt dashboard definitions.

1. Identify the ID of the broken dashboard via the URL when viewing it.
2. Export the dashboard object using the Saved Objects API to a local JSON file.
3. Perform a find-and-replace of the old indexpattern ID with the new ID.
4. Import the updated JSON back into Kibana.

Verification and Testing

To ensure the fix is successful, perform these two checks:

• Dashboard Load: Refresh the affected dashboard. The "Index Pattern Not Found" banner should disappear, and panels should populate.
• Discover Validation: Navigate to the Discover tab, select the restored index pattern, and run a query for the last 15 minutes. If rows appear, the link between Kibana and Elasticsearch is fully restored.

Escalation Criteria

If the following conditions persist, escalate to your Elasticsearch cluster administrator:

• The _cat/indices API returns no results for the expected pattern, indicating indices were deleted or failed to rotate.
• The index pattern is present, but fields are marked as "unmapped" or missing, suggesting a mapping explosion or schema change in Elasticsearch.
• Updating the Saved Object via API returns a 400 Bad Request, indicating a version mismatch between the exported JSON and the current Kibana version.