"Discover: Unable to parse/seralize body" due to truncated HTTP response

Hi @EldrosKandar

If you can capture traffic between ES and Kibana and between Kibana and browser with Wireshark when issue happens and attach this to the GitHub issue (assuming you have no sensitive data there), that would definitely be very useful.

Hi @azasypkin,

So I could capture the traffic while I made a call through the Console, now how do I provide this data to the devs without compromising potentially sensitive data? Alternatively, I can have a look at it myself, but what I am looking for? Also it doesn't seem to capture any traffic between services on the same host, as it is the case for ES and Kibana...

Hi @azasypkin

So I figured out how to use tshark on my remote server to get a dump file and I could only confirm what I suspected:

  1. Browser send (Communication between port server:5601 and workmachine:54245)
    POST /api/console/proxy?path=%2Findex-2018.07.10%2F_search&method=POST HTTP/1.1\r\n
  2. Elasticsearch becomes (Communication on the server between port 9200 and 39486)
    POST /index-2018.07.10/_search HTTP/1.1\r\n
  3. Elasticsearch generates the complete response (response to local communication)
  4. Truncated answer is send back to Kibana (response to communication server/workmachine)

I don't know how helpful it would be to the dev though...

Hi @azasypkin,

I've just updated our Elastic Stack to 6.3.2 and since then I couldn't reproduce the issue anymore.

Hi @EldrosKandar,

Thanks a lot for getting back to us with the update and sorry for the delayed response! I'll close the issue for now, but feel free to re-open it if you hit by this issue again.

Best,
Oleg

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.