Getting Zero or negative time interval not supported after running load.sh on non beats indices

[damm]

So based in the conversation in #2 I was getting that wonderful error. It appears the default search when running load.sh is looking into packetbeat; I don't use packetbeat.

Anyway this breaks Kibana actually; having to delete the logstash- pattern and rebuild it from scratch

I suspect it's the Default Search item; I forked it and nuked a bunch of crud and it works as I expect.

[ruflin]

As far as I can see, this is a general issue that applies to all search patterns, as the index is hardcoded: https://github.com/elastic/beats-dashboards/tree/master/dashboards/search This means, in case you don't use the default index pattern, the searches will not work.

We should probably introduce environment variables where the index patterns for each beat can be defined and are then loaded into the template before sending it to the elasticsearch. Something like: load.sh TOPBEAT_INDEX=logstash-*

[damm]

That's the experience I had; deleting https://github.com/elastic/beats-dashboards/blob/master/dashboards/search/Default-Search.json fixed it.

I suspect having people run load.sh and not being able to query anything but packetbeat data is not the expected result?

[monicasarbu]

@damm Yes, it's a bug. Our goal is to be able to query packetbeat data along with other data. Thanks for reporting it.