No data in in Kibana no data streams in elasticsearch

[DebianGuru]

Version

2.4.50

Installation Method

Other (please provide detail below)

Description

upgrading

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

20

RAM

18GB

Storage for /

166G

Storage for /nsm

3.4TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

I tried upgrading from 2.3 to 2.4 and have had some issues. First, MySQL didn't upgrade, but that was in another discussion. Now, here's a more pressing issue. I have no data in Alerts or Hunt, or Kibana. What I have noticed is that in elastic>Stack Management>Index Management>Data Streams is completely blank. On my working (test)version of so2.4, there are 22 data streams listed. I also see that most "Index Lifecycle Policies" are missing on the broken system also. Is there a way to fix this?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[DebianGuru]

Okay, got the fleet stuff setup with "so-elastic-fleet-setup" with added all the Data Streams and "so-elasticsearch-ilm-load" seemed to set the "Index Lifecycle Policies" populated like my test machine. Still can't see old data (before upgrade) through Kibana or SOC. I can see old data through the "Hunt" or throught "Dashboards".. What gives.

[cm-ops]

Your default data view in Kibana is logs-*, in SOC (except Alerts), it is also querying the old logs via so-* as well as the new logs-*.

[DebianGuru]

I suspected that the data being looked at was coming through a different sort of query. Is there any documentation or can you tell me if/how i can either resolve this or at least where I can change the views?