Error from stock auditbeat dashboards

Elastic Stack Kibana
#1

I installed the 'stock' auditbeat dashboards for v7.10. Opening the 'System Overview ECS' I get this error on the majority of the panels:

search_phase_execution_exception
Error: Bad Request
at Fetch._callee3$ (http://10.95.96.38/36063/bundles/core/core.entry.js:6:59535)
at l (http://10.95.96.38/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740520)
at Generator._invoke (http://10.95.96.38/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740273)
at Generator.forEach.e.<computed> [as next] (http://10.95.96.38/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740877)
at fetch_asyncGeneratorStep (http://10.95.96.38/36063/bundles/core/core.entry.js:6:52652)
at _next (http://10.95.96.38/36063/bundles/core/core.entry.js:6:52968)
#2

Hi @ethrbunny, I've just followed the steps to set these up on Cloud and it worked as expected on my end.

Can you see any errors in the console of the Developer Tools in your browser?
Are you upgrading from a previous version? If so, did you have the dashboards previously loaded?
Can you try deleting the Saved Objects (Dashboards and Visualizations) and running it again?

Sorry for the number of questions :slight_smile:

#3

my setup requires me to reload all dashboards with every upgrade - so no - all new.

Where do I find this console?

#4

This is the output from the browser 'console' - there are lots of these messages:

Detected an unhandled Promise rejection.>

Error: Not Found
core.entry.js:6 Uncaught (in promise) Error: Not Found
at Fetch._callee3$ (core.entry.js:6)
at l (kbn-ui-shared-deps.js:380)
at Generator._invoke (kbn-ui-shared-deps.js:380)
at Generator.forEach.e. [as next] (kbn-ui-shared-deps.js:380)
at fetch_asyncGeneratorStep (core.entry.js:6)
at _next (core.entry.js:6)
/internal/search/ese/Fm5zY2ZvWE9qUlhTNWd1OHVVell4YlEgV0c0bGptN3NTem1rMXNPa2tZNVpndzoxMTUxOTg1NDk=:1 Failed to load resource: the server responded with a status of 404 (Not Found)

#5

Getting same error on some metricbeat visualizations too

#6

Looks like if I edit the problematic visualizations - in many cases by changing the metrics to use/include the '.keyword' version the problem can be fixed.

1 Like