"Error" in Documents Count - Index Management

Elastic Stack Kibana
1

Hi everyone,

I recently upgraded my environment to Elastic 9.3, and I’ve encountered a specific issue in the Index Management section that wasn't present before.

400badrequest
400badrequest3144×1711 464 KB

The Problem

When I set the page to display 100 rows, the "Documents" column fails to load and displays a red "Error" for all indices. Checking the browser DevTools, I see a 400 Bad Request triggered by a call to index_doc_count.

The specific error returned is:

"type": "too_long_http_line_exception", "reason": "An HTTP line is larger than 4096 bytes."

It's worth noting that if I revert the settings to display only 10 rows, the issue disappears and everything loads correctly without any errors.

Comparison with v9.2.2

I tested the exact same scenario on my non-production cluster, which is still running v9.2.2. In that version, the indices load perfectly fine even with 100 rows displayed. Interestingly, I noticed that in v9.2.2, there doesn't seem to be a specific call to index_doc_count like the one causing the failure in v9.3.

Technical Observation

I understand that, technically, this is an HTTP limitation (the URL/header line becoming too long for the server to process). However, I wanted to report this because:

  1. It appears to be a change in behavior in 9.3.

  2. The way Kibana now fetches document counts (via this new or modified index_doc_count request) creates a URL that exceeds standard HTTP limits when viewing a large number of indices simultaneously.

Has anyone else experienced this after the 9.3 upgrade? Is there a known workaround or a setting to adjust how these counts are requested?

Thanks in advance for any insights!

2

I was just able to replicate this on a 9.3.0 Cloud Deployment.

image
image2502×442 51.3 KB

I can see the same error in the request:

{
    "statusCode": 400,
    "error": "Bad Request",
    "message": "An HTTP line is larger than 4096 bytes.",
    "attributes": {
        "error": {
            "root_cause": [
                {
                    "type": "too_long_http_line_exception",
                    "reason": "An HTTP line is larger than 4096 bytes."
                }
            ],
            "type": "too_long_http_line_exception",
            "reason": "An HTTP line is larger than 4096 bytes."
        }
    }
}

This looks like a bug, not sure if it was already reported on Github.

3

Hi Leandro,
thank you for your reply!

I confirm, it's a bug that will be fixed in version 9.3.1.

I just found an article in the knowledge base now.

The solution for now is:

image

4

Hi :waving_hand:

This error seem to occurs more globally when an error is thrown on /index_doc_count, for example, with a 403 when an index is closed. I’m not sure if this is considered expected behavior.

It would be helpful to make the error message more explicit. Currently, when loading the page, if the “guilty” index is present, the doc_count for all other indices in the same page are displayed as “Error”.
A targeted message on the specific index would make the problem much easier to understand.

{statusCode: 403, error: "Forbidden",…}

attributes: {error: {root_cause: [{type: "cluster_block_exception",…}], type: "cluster_block_exception",…}}

error: "Forbidden"

message: "index [index-exporter] blocked by: [FORBIDDEN/4/index closed];"

statusCode: 403

Hope that it helps.

Edit: using v9.3.1