Child "meta_fields" fails?

Elastic Stack Kibana
1

Tried updating to 7.3 today. I now get this error when opening the Discover pane, or trying to review the fields of specific indexes under "Management / Index patterns"

child "meta_fields" fails because ["meta_fields" must be an array]

request/<@https://192.168.0.239/kibana/bundles/commons.bundle.js:3:2481398
run@https://192.168.0.239/kibana/built_assets/dlls/vendors.bundle.dll.js:364:96865
notify/<@https://192.168.0.239/kibana/built_assets/dlls/vendors.bundle.dll.js:364:97152
flush@https://192.168.0.239/kibana/built_assets/dlls/vendors.bundle.dll.js:364:101897

I can't find any discussion of this besides this old discuss topic that was never responded to...

2

Hello,
Can you provide Kibana logs, screenshots, browser console logs etc. what were the steps you took ? May be try deleting the index and re-creating it and see if it disappears.
What is the meta_fields field like ?

Thanks
Rashmi

3

The issue seems to mysteriously now be resolved on the VM it was occurring on. I think I had played with the "Meta fields" setting, but failed to restart Kibana, but I'm not sure. I was consistently seeing the issue with 7.3 deployments though, so I'll attempt a repeat deployment shortly to see if it still re-occurs.

I'll attempt to paste in my Kibana.log in a following post; it's large so I'm unclear it will be allowed; and this site only seems to allow for image attachments.

Actions taken

  • Added Elasticsearch Repo:
    wget -timeout=15 --tries=5 -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
    sudo bash -c "echo 'deb https://artifacts.elastic.co/packages/7.x/apt stable main' >> /etc/apt/sources.list.d/elastic-7.x.list"
  • Installed ELK 7.3: sudo apt-fast install -y elasticsearch kibana logstash
  • Updated my JVM config to disable illegal reflective access warnings
  • Set base path for Kibana reverse proxy access
  • Disabled: Application Performance Monitoring interface, Infrastructure and Logs interfaces, Telemetry
  • Added delay to Kibana service to to allow for Elasticsearch initialization /wo extensive errors/warnings
  • Start ELK services
  • Load a default index pattern:
    {
    "attributes": {
    "title": "logstash-*",
    "timeFieldName": "@timestamp",
    "sourceFilters": "[{"value":"@version"},{"value":"alert.metadata.engine"},{"value":"in_iface"},{"value":"path"},{"value":"type"}]"
    }
    }
  • Set a default date format: curl --connect-timeout 15 -s -X POST http://localhost:5601/kibana/api/kibana/settings/dateFormat -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"value": "YY-MM-DD HH:mm:ss.SSS"}'
  • Set Kibana default index pattern: curl --connect-timeout 15 -s -X POST http://localhost:5601/kibana/api/kibana/settings/defaultIndex -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"value": "logstash-*"}'
  • Set Kibana Discovery search size: curl --connect-timeout 15 -X POST http://localhost:5601/kibana/api/kibana/settings/discover:sampleSize -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"value": "1000"}'
  • Hide Kibana fields found outside of source: curl --connect-timeout 15 -s -X POST http://localhost:5601/kibana/api/kibana/settings/metaFields -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"value": ["_source"]}'
  • Loaded a few dashboards / visualizations
  • Rebooted
  • Got errors from any dashboard /w a discover pane and the discover pane itself.

The meta_fields field is set per the curl above as: "_source"

In general the error provided here could be more explicit. I wasn't clear what meta_fields even was; and didn't realize it was one of Kibana's Advanced Settings.

4

No way to directly submit large log files here. Here is a Pastebin that will be availible till Sept 12th.

https://pastebin.com/zkjCCiCg

5

Great to know your issue was resolved although by multiple restarts. Thanks for posting what you did. Helpful for the community.

Thanks
Rashmi

6

Not resolved. It reoccurs on a repeat deployment. I think I had just failed to restart Kibana after revising Meta fields when poking at things previously.

Here is the content of...
http://localhost:5601/kibana/api/kibana/settings
...returns...
{"settings":{"buildNum":{"userValue":25250},"dateFormat":{"userValue":"YY-MM-DD HH:mm:ss.SSS"},"defaultIndex":{"userValue":"logstash-*"},"discover:sampleSize":{"userValue":"1000"},"metaFields":{"userValue":["_source"]}}}
...where metaFields is an array.

Resetting "Meta fields" to the default via the UI: _source, _id, _type, _index, _score or any value that contains multiple fields resolves the issue; but setting it to _source , or any singular field (i.e. _id ) via the UI causes it to return; even though the singular value is still stored as an array (Kibana must be restarted between edits).

There does seem to be a bug here with how Meta fields is handled in 7.3: https://github.com/elastic/kibana/issues/43167

9

Thankyou for opening the bug. We shall investigate further.

Thanks
Rashmi

10

Is there any update on this? I have the same error on beats indexes. I have two other indexes that are working fine.

Error fetching fields

child "meta_fields" fails because ["meta_fields" must be an array]

11

plz subscribe to the bug and you will get updates when it will be fixed.

Thanks
Rashmi

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.