Bad request when generating CSV -> HPE_HEADER_OVERFLOW

[Zzo]

Hi,

I'm running the basic edition of ES and Kibana 6.5.3.
Since I moved from 6.5.0 to 6.5.3 I have some issue when generating CSV from the Discover.
I have a popup with "Reporting error : Bad request".
And in the kibana.log : {"type":"error","@timestamp":"2018-12-21T09:42:59Z","tags":["connection","client","error"],"pid":10376,"level":"error","error":{"message":"Parse Error","name":"Error","stack":"Error: Parse Error","code":"HPE_HEADER_OVERFLOW"},"message":"Parse Error"}

This happens when I add a specific computed field from the number/percentage format which calculate a security score for my assets stored in my assets index.
How can I solve the issue so I can export in CSV just like when running 6.5.0?

Regards

[spalger (Spencer Alger)]

Kibana 6.5.3 upgraded to node.js 8.14.0, which has a fix for CVE-2018-12121. This imposes an 8k limit on the headers, which it would seem is what you've bumped into. I've created https://github.com/elastic/kibana/issues/27724 which hopefully we can address after the holidays here in the US.

You might want to inspect the headers that your browser is sending to Kibana, if there is anything massive in there that might not be necessary (maybe a cookie injected by a proxy or something) you might be able to get rid of it and get things working.

[Alberto_Yoldi]

We are also facing the same issue as there is an Apache server infront that performs the Kerberos authentication. I hope it can be solved soon, as its critical for us and is a clear stopper for taking the upgrade to production

Thanks @Zzo for reporting and @spalger for taking care!

Regards,

[tylersmalley]

@Alberto_Yoldi are you only seeing this limit reached for the Kerberos authentication? Do you know the header size it requires?

[Zzo]

Thank you and sorry for the late reply due to holidays.
I have rolled back to 6.4.3 and now it's working fine again.
I think my scripted fields are way to heavy for the 8K limit.
How can I check the size of the headers?

[Ram_Varra]

I am seeing the same issue with with 6.5.4 Version. The Kibana logs reporting parse errors with code; 'HPE_HEADER_OVERFLOW' most of the time. Is there any plan to address this soon or should we downgrade to 6.4.3 for now?