ElasticSearch WARN after installing kibana

Elastic Stack Elasticsearch
#1

After installing kibana,when i operate(GET/POST/DELETE and so on) Elastic Search with High Level Rest Clinet comes up this warning:

Each request comes up with one warning,i have 500 millions documents to process every months,this problem would flush my logs and i can't locate the new problem.

i wonder what causes this problem and how to fix it.Thanks.

Version:
-Elastic Search/kibana: 7.10.1

#2

Welcome to our community! :smiley:

What URL does it mention?

If this is Kibana, then it won't be displayed every single time a new document is ingested.

#3

Thanks for your reply
Urls:

  • POST https://{hostname}:9200/_bulk?timeout=1m (would post this request like million times)
  • GET https://{hostname}:9200/_cat/indices?index=user_data-*
  • DELETE https://{hostname}:9200/user_data-20210325160624?master_timeout=30s&ignore_unavailable=false&expand_wildcards=open%2Cclosed&allow_no_indices=true&ignore_throttled=false&timeout=30s

Thanks again.

#4

Does anybody have the same question and resolve?

#5

I'm surprised that those queries generate a log which is not related.

High Level Rest Clinet

What is the exact Java code you run when this log is printed?

#6

Thanks for your reply!
Here is the java code:

        Assert.notNull(indexName, "es bulk index with null index name!");
        Assert.notNull(userDatas, "es bulk index with null requests entity!");
        if(CollectionUtils.isEmpty(userDatas)){
            return;
        }

        BulkRequest bulkRequest = new BulkRequest();
        for(UserData userData : userDatas){
            Assert.notNull(userData, "userData is null!");
            log.debug(userData.toString());

            RedisUserLabelData labelData;
            try {
                labelData = RedisUserLabelData.buildFromMysqlUserData(userData);
            } catch (Exception e){
                log.error("RedisUserLabelData build from mysql entity UserData failed!", e);
                continue;
            }

            Map<String, Object> dataMap;
            try {
                dataMap = PropertyUtils.describe(labelData);

                /** 去掉class字段 **/
                dataMap.remove("class");
            } catch (Exception e){
                throw new RuntimeException("beanUtil, bean to map transform failed!", e);
            }

            Assert.notNull(dataMap, "beanUtil, bean to map result null map");
            Assert.notEmpty(dataMap, "beanUtil, bean to map result empty map");

            IndexRequest indexRequest = new IndexRequest("posts").source(dataMap).index(indexName);
            bulkRequest.add(indexRequest);

        }

        if(bulkRequest.numberOfActions() != userDatas.size()){
            throw new RuntimeException("bulk request has requests number not equal to the parameter collection size!");
        }

        if(bulkRequest.numberOfActions() > 0) {
            BulkResponse bulkResponse = null;
            try {
                bulkResponse = restHighLevelClient.bulk(bulkRequest, RequestOptions.DEFAULT);
            } catch (IOException e) {
                throw new RuntimeException("Error connect to Es", e);
            }

            if(bulkResponse.hasFailures()){
                BulkItemResponse[] bulkItemResponseArr = bulkResponse.getItems();
                for(BulkItemResponse bulkItemResponse : bulkItemResponseArr){
                    if(bulkItemResponse.isFailed()){
                        log.error("error while indexing : " + bulkItemResponse.getFailureMessage(), bulkItemResponse.getFailure().getCause());
                    }
                }
            }
        }

I find no way to highlight the exact code where the log is printed, so i quote here:

bulkResponse = restHighLevelClient.bulk(bulkRequest, RequestOptions.DEFAULT);

Everytime I send request(get/post/delete etc) to ElasticSearch,the log is printed.In order not to delay your time, i do not show the other code.
Thanks again!

#7 
IndexRequest indexRequest = new IndexRequest("posts").source(dataMap).index(indexName);

Why did you add .index(indexName)?
And what is the value of indexName?

#8

how does it know which index I want to update if not add .index(indexName) ?
The indexName is
"UserData" + "-" + new SimpleDateFormat("yyyyMMddHHmmss").format(Calendar.getInstance().getTime()
After the update finishing, the index would be alias as "UserData"

#9

But you set the index name with:

new IndexRequest("posts")

So I'd write instead:

IndexRequest indexRequest = new IndexRequest(indexName).source(dataMap);

And BTW, I think you are missing the JSON content type.

I think it should be:

IndexRequest indexRequest = new IndexRequest(indexName).source(dataMap, XContentType.JSON));

(But unsure as I never use maps to send data to Elasticsearch).

I can't see the correlation with the log message...

this request accesses system indices: [.kibana_1, .kibana_task_manager_1]

I'm wondering if we are really looking at the exact code which is generating this log.
I'd have expect a _search request TBH.

Are you sure you are not running a Search after the bulk or at the same time?

#10

Yes, you're right.Thanks for your correction.

I'm convinced that there no Search running at the same tiem.

Search also would print the log as follow:
2021-04-02 15:59:10 [20210402155858991] [http-nio-8233-exec-1] WARN org.elasticsearch.client.RestClient - request [PUT https://hostname:9200/sync_ads_order_persist-in/_doc/37944?timeout=1m] returned 1 warnings: [299 Elasticsearch-7.10.1-1c34507e66d7db1211f66f3513706fdf548736aa "this request accesses system indices: [.kibana_1, .kibana_task_manager_1], but in a future major version, direct access to system indices will be prevented by default"]

BTW, I am wondering if Search Guard leads to this problem, because I installed Search Guard and Kibana at the same time.

Thank for your help and your patience.

#11

Ha! That's probably it.

We don't support this 3rd party plugin here. We have security available in our default free distribution.

#12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.