Error in Kibana while creating Visualization

Elastic Stack Kibana
1

I get Below error in Kibana while creating visualization. My elastic search index has 2 fields. One is timestamp and other one is client IP address.

Any help is appreciated.

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"circuit_breaking_exception","reason":"[request] Data too large, data for [<reused_arrays>] would be [633190400/603.8mb], which is larger than the limit of [623326003/594.4mb]","bytes_wanted":633190400,"bytes_limit":623326003},{"type":"circuit_breaking_exception","reason":"[request] Data too large, data for [<reused_arrays>] would be [625002496/596mb], which is larger than the limit of [623326003/594.4mb]","bytes_wanted":625002496,"bytes_limit":623326003},{"type":"circuit_breaking_exception","reason":"[request] Data too large, data for [<reused_arrays>] would be [639170560/609.5mb], which is larger than the limit of [623326003/594.4mb]","bytes_wanted":639170560,"bytes_limit":623326003},{"type":"circuit_breaking_exception","reason":"[request] Data too large, data for [<reused_arrays>] would be [658073600/627.5mb], which is larger than the limit of [623326003/594.4mb]","bytes_wanted":658073600,"bytes_limit":623326003}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"clientipaddress","node":"SQeesF7ER7iZId0EFKnpCw","reason":{"type":"circuit_breaking_exception","reason":"[request] Data too large, data for [<reused_arrays>] would be [633190400/603.8mb], which is larger than the limit of [623326003/594.4mb]","bytes_wanted":633190400,"bytes_limit":623326003}},{"shard":1,"index":"clientipaddress","node":"SQeesF7ER7iZId0EFKnpCw","reason":{"type":"circuit_breaking_exception","reason":"[request] Data too large, data for [<reused_arrays>] would be [625002496/596mb], which is larger than the limit of [623326003/594.4mb]","bytes_wanted":625002496,"bytes_limit":623326003}},{"shard":2,"index":"clientipaddress","node":"SQeesF7ER7iZId0EFKnpCw","reason":{"type":"circuit_breaking_exception","reason":"[request] Data too large, data for [<reused_arrays>] would be [639170560/609.5mb], which is larger than the limit of [623326003/594.4mb]","bytes_wanted":639170560,"bytes_limit":623326003}},{"shard":4,"index":"clientipaddress","node":"SQeesF7ER7iZId0EFKnpCw","reason":{"type":"circuit_breaking_exception","reason":"[request] Data too large, data for [<reused_arrays>] would be [658073600/627.5mb], which is larger than the limit of [623326003/594.4mb]","bytes_wanted":658073600,"bytes_limit":623326003}}]},"status":503}

at http://localhost:5601/bundles/commons.bundle.js:3:947991

at Function.Promise.try (http://localhost:5601/bundles/commons.bundle.js:3:824444)

at http://localhost:5601/bundles/commons.bundle.js:3:823832

at Array.map (&lt;anonymous&gt;)

at Function.Promise.map (http://localhost:5601/bundles/commons.bundle.js:3:823790)

at callResponseHandlers (http://localhost:5601/bundles/commons.bundle.js:3:947569)

at http://localhost:5601/bundles/commons.bundle.js:3:936592

at processQueue (http://localhost:5601/bundles/vendors.bundle.js:133:134252)

at http://localhost:5601/bundles/vendors.bundle.js:133:135201

at Scope.$digest (http://localhost:5601/bundles/vendors.bundle.js:133:146077)

at Scope.$apply (http://localhost:5601/bundles/vendors.bundle.js:133:148856)

at done (http://localhost:5601/bundles/vendors.bundle.js:133:101124)

at completeRequest (http://localhost:5601/bundles/vendors.bundle.js:133:106024)

at XMLHttpRequest.xhr.onload (http://localhost:5601/bundles/vendors.bundle.js:133:106783)
2

Hi, take a look at this issue in Elasticsearch that seems to be the same as what you are encountering: https://github.com/elastic/elasticsearch/issues/24359. There is a comment down in the thread that explains how to apply a workaround in Kibana.

Also, what version of Kibana is this?

3

Thanks Tim.
I am using Kibana version 6.3.2 and elastic search version 6.3.2.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.