CSV Report generation fails with large KQL query

I am running Elasticsearch + Kibana 7.8.0 on a virtual machine, everything in the cluster is operating fine with no issues.

In the last few days, I was trying to run a long query (written in KQL) in the search bar (Discover), showing my good results after taking a while to process and I got the warning that it is capturing results beyond the regular timeout.

After rendering all results, I wanted to generate and download a CSV report as I usually do, only to be prompted with a failure message (after 3 attempts) after it reached timeout.

The number of hits in the results wasn't that large to be an issue and I also tried a shorter time range with no success.

Then I tried to change the xpack.reporting configuration, setting:
xpack.reporting.queue.timeout from 120000 (default) to 300000 and 600000, still getting the same failure as before (but with longer queue processing time).

I suspect it may be something to do with generating a report with a "heavy" KQL query, but I am not sure.

If there is any additional debugging to do or some insights about this issue, please help to solve it.


Hey @tomervain, this sounds a lot like a bug report which are super useful!

If you could, collect whatever logs or browser errors Kibana and ES might be spitting out and file a bug report in Kibana on Github.

Tagging your issue with "bug", "triaged_needed", "Feature:Reporting", and "Team:Reporting Services" will get it the quickest attention.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.