Filebeat-* index pattern Search Error in Discover

mkay299 · December 31, 2021, 8:06pm

So I had some issues with my filebeat-* index it wasn't updating on the new fields correctly so I deleted it and remade it. after I recreated it I get the following error in discovery. and none of the dashboards work as if there is no filebeat-* index.

search_phase_execution_exception


Error: Bad Request
    at Fetch._callee3$ (https://site.name.com:5601/35949/bundles/core/core.entry.js:6:59535)
    at l (https://site.name.com:5601/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740519)
    at Generator._invoke (https://site.name.com:5601/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740272)
    at Generator.forEach.e.<computed> [as next] (https://site.name.com:5601/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740876)
    at fetch_asyncGeneratorStep (https://site.name.com:5601/35949/bundles/core/core.entry.js:6:52652)
    at _next (https://site.name.com:5601/35949/bundles/core/core.entry.js:6:52968)

mkay299 · December 31, 2021, 9:56pm

output from kibana log:

{"type":"log","@timestamp":"2021-12-31T21:41:01Z","tags":["info","plugins-service"],"pid":6718,"message":"Plugin \"visTypeXy\" is disabled."}
{"type":"log","@timestamp":"2021-12-31T21:41:01Z","tags":["info","plugins-service"],"pid":6718,"message":"Plugin \"auditTrail\" is disabled."}
{"type":"log","@timestamp":"2021-12-31T21:41:01Z","tags":["warning","config","deprecation"],"pid":6718,"message":"Setting [elasticsearch.username] to \"elastic\" is deprecated. You should use the \"kibana_system\" user instead."}
{"type":"log","@timestamp":"2021-12-31T21:41:01Z","tags":["warning","config","deprecation"],"pid":6718,"message":"Config key [monitoring.cluster_alerts.email_notifications.email_address] will be required for email notifications to work in 8.0.\""}
{"type":"log","@timestamp":"2021-12-31T21:41:01Z","tags":["warning","config","deprecation"],"pid":6718,"message":"Setting [monitoring.username] to \"elastic\" is deprecated. You should use the \"kibana_system\" user instead."}
{"type":"log","@timestamp":"2021-12-31T21:41:01Z","tags":["info","plugins-system"],"pid":6718,"message":"Setting up [96] plugins: [taskManager,licensing,globalSearch,globalSearchProviders,code,usageCollection,xpackLegacy,telemetryCollectionManager,telemetry,telemetryCollectionXpack,kibanaUsageCollection,securityOss,newsfeed,mapsLegacy,kibanaLegacy,translations,share,legacyExport,embeddable,uiActionsEnhanced,expressions,data,home,observability,cloud,console,consoleExtensions,apmOss,searchprofiler,painlessLab,grokdebugger,management,indexPatternManagement,advancedSettings,fileUpload,savedObjects,dashboard,visualizations,visTypeVega,visTypeTimelion,timelion,features,upgradeAssistant,security,snapshotRestore,enterpriseSearch,encryptedSavedObjects,ingestManager,indexManagement,remoteClusters,crossClusterReplication,indexLifecycleManagement,dashboardMode,beatsManagement,transform,ingestPipelines,maps,licenseManagement,graph,dataEnhanced,visTypeTable,visTypeMarkdown,tileMap,regionMap,inputControlVis,visualize,esUiShared,charts,lens,visTypeVislib,visTypeTimeseries,rollup,visTypeTagcloud,visTypeMetric,watcher,discover,discoverEnhanced,savedObjectsManagement,spaces,reporting,lists,eventLog,actions,case,alerts,stackAlerts,triggersActionsUi,ml,securitySolution,infra,monitoring,logstash,apm,uptime,bfetch,canvas]"}
{"type":"log","@timestamp":"2021-12-31T21:41:01Z","tags":["warning","plugins","security","config"],"pid":6718,"message":"Generating a random key for xpack.security.encryptionKey. To prevent sessions from being invalidated on restart, please set xpack.security.encryptionKey in kibana.yml"}
{"type":"log","@timestamp":"2021-12-31T21:41:02Z","tags":["warning","plugins","encryptedSavedObjects","config"],"pid":6718,"message":"Generating a random key for xpack.encryptedSavedObjects.encryptionKey. To be able to decrypt encrypted saved objects attributes after restart, please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml"}
{"type":"log","@timestamp":"2021-12-31T21:41:02Z","tags":["warning","plugins","ingestManager"],"pid":6718,"message":"Fleet APIs are disabled due to the Encrypted Saved Objects plugin using an ephemeral encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml."}
{"type":"log","@timestamp":"2021-12-31T21:41:02Z","tags":["warning","plugins","reporting","config"],"pid":6718,"message":"Generating a random key for xpack.reporting.encryptionKey. To prevent sessions from being invalidated on restart, please set xpack.reporting.encryptionKey in kibana.yml"}
{"type":"log","@timestamp":"2021-12-31T21:41:02Z","tags":["warning","plugins","reporting","config"],"pid":6718,"message":"Chromium sandbox provides an additional layer of protection, but is not supported for Linux CentOS 7.7.1908 OS. Automatically setting 'xpack.reporting.capture.browser.chromium.disableSandbox: true'."}
{"type":"log","@timestamp":"2021-12-31T21:41:02Z","tags":["warning","plugins","actions","actions"],"pid":6718,"message":"APIs are disabled due to the Encrypted Saved Objects plugin using an ephemeral encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml."}
{"type":"log","@timestamp":"2021-12-31T21:41:02Z","tags":["warning","plugins","alerts","plugins","alerting"],"pid":6718,"message":"APIs are disabled due to the Encrypted Saved Objects plugin using an ephemeral encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml."}
{"type":"log","@timestamp":"2021-12-31T21:41:02Z","tags":["info","plugins","monitoring","monitoring"],"pid":6718,"message":"config sourced from: production cluster"}
{"type":"log","@timestamp":"2021-12-31T21:41:02Z","tags":["info","savedobjects-service"],"pid":6718,"message":"Waiting until all Elasticsearch nodes are compatible with Kibana before starting saved objects migrations..."}
{"type":"log","@timestamp":"2021-12-31T21:41:02Z","tags":["info","savedobjects-service"],"pid":6718,"message":"Starting saved objects migrations"}
{"type":"log","@timestamp":"2021-12-31T21:41:03Z","tags":["info","plugins-system"],"pid":6718,"message":"Starting [96] plugins: [taskManager,licensing,globalSearch,globalSearchProviders,code,usageCollection,xpackLegacy,telemetryCollectionManager,telemetry,telemetryCollectionXpack,kibanaUsageCollection,securityOss,newsfeed,mapsLegacy,kibanaLegacy,translations,share,legacyExport,embeddable,uiActionsEnhanced,expressions,data,home,observability,cloud,console,consoleExtensions,apmOss,searchprofiler,painlessLab,grokdebugger,management,indexPatternManagement,advancedSettings,fileUpload,savedObjects,dashboard,visualizations,visTypeVega,visTypeTimelion,timelion,features,upgradeAssistant,security,snapshotRestore,enterpriseSearch,encryptedSavedObjects,ingestManager,indexManagement,remoteClusters,crossClusterReplication,indexLifecycleManagement,dashboardMode,beatsManagement,transform,ingestPipelines,maps,licenseManagement,graph,dataEnhanced,visTypeTable,visTypeMarkdown,tileMap,regionMap,inputControlVis,visualize,esUiShared,charts,lens,visTypeVislib,visTypeTimeseries,rollup,visTypeTagcloud,visTypeMetric,watcher,discover,discoverEnhanced,savedObjectsManagement,spaces,reporting,lists,eventLog,actions,case,alerts,stackAlerts,triggersActionsUi,ml,securitySolution,infra,monitoring,logstash,apm,uptime,bfetch,canvas]"}
{"type":"log","@timestamp":"2021-12-31T21:41:03Z","tags":["info","plugins","taskManager","taskManager"],"pid":6718,"message":"TaskManager is identified by the Kibana UUID: ca5e2fb7-500a-4939-972a-5c1e983e820d"}
{"type":"log","@timestamp":"2021-12-31T21:41:03Z","tags":["info","plugins","crossClusterReplication"],"pid":6718,"message":"Your basic license does not support crossClusterReplication. Please upgrade your license."}
{"type":"log","@timestamp":"2021-12-31T21:41:03Z","tags":["info","plugins","watcher"],"pid":6718,"message":"Your basic license does not support watcher. Please upgrade your license."}
{"type":"log","@timestamp":"2021-12-31T21:41:03Z","tags":["info","plugins","monitoring","monitoring","kibana-monitoring"],"pid":6718,"message":"Starting monitoring stats collection"}
{"type":"log","@timestamp":"2021-12-31T21:41:04Z","tags":["error","elasticsearch","data"],"pid":6718,"message":"[version_conflict_engine_exception]: [task:Alerting-alerting_telemetry]: version conflict, document already exists (current version [1144])"}
{"type":"log","@timestamp":"2021-12-31T21:41:04Z","tags":["error","elasticsearch","data"],"pid":6718,"message":"[version_conflict_engine_exception]: [task:endpoint:user-artifact-packager:1.0.0]: version conflict, document already exists (current version [1553328])"}
{"type":"log","@timestamp":"2021-12-31T21:41:04Z","tags":["error","elasticsearch","data"],"pid":6718,"message":"[version_conflict_engine_exception]: [task:Actions-actions_telemetry]: version conflict, document already exists (current version [1144])"}
{"type":"log","@timestamp":"2021-12-31T21:41:04Z","tags":["error","elasticsearch","data"],"pid":6718,"message":"[version_conflict_engine_exception]: [task:Lens-lens_telemetry]: version conflict, document already exists (current version [1144])"}
{"type":"log","@timestamp":"2021-12-31T21:41:04Z","tags":["error","elasticsearch","data"],"pid":6718,"message":"[version_conflict_engine_exception]: [task:apm-telemetry-task]: version conflict, document already exists (current version [2275])"}
{"type":"log","@timestamp":"2021-12-31T21:41:04Z","tags":["listening","info"],"pid":6718,"message":"Server running at https://SERVER.IP:5601"}
{"type":"log","@timestamp":"2021-12-31T21:41:05Z","tags":["warning","plugins","reporting"],"pid":6718,"message":"Enabling the Chromium sandbox provides an additional layer of protection."}
{"type":"log","@timestamp":"2021-12-31T21:41:10Z","tags":["info","http","server","Kibana"],"pid":6718,"message":"http server running at https://SERVER.IP:5601"}

mkay299 · December 31, 2021, 10:01pm

{"type":"response","@timestamp":"2021-12-31T21:41:34Z","tags":[],"pid":6718,"method":"get","statusCode":200,"req":{"url":"/internal/security/session","method":"get","headers":{"host":"site.name.com:5601","connection":"keep-alive","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","kbn-system-request":"true","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/home","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/home"},"res":{"statusCode":200,"responseTime":46,"contentLength":9},"message":"GET /internal/security/session 200 46ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:34Z","tags":[],"pid":6718,"method":"get","statusCode":200,"req":{"url":"/internal/security/me","method":"get","headers":{"host":"site.name.com:5601","connection":"keep-alive","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","kbn-system-request":"true","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/home","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/home"},"res":{"statusCode":200,"responseTime":25,"contentLength":9},"message":"GET /internal/security/me 200 25ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:34Z","tags":[],"pid":6718,"method":"get","statusCode":200,"req":{"url":"/ui/fonts/inter_ui/Inter-UI-Light-BETA.woff2","method":"get","headers":{"host":"site.name.com:5601","connection":"keep-alive","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","origin":"https://site.name.com:5601","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"font","referer":"https://site.name.com:5601/app/home","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/home"},"res":{"statusCode":200,"responseTime":16,"contentLength":9},"message":"GET /ui/fonts/inter_ui/Inter-UI-Light-BETA.woff2 200 16ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:34Z","tags":[],"pid":6718,"method":"post","statusCode":200,"req":{"url":"/api/saved_objects/_bulk_get","method":"post","headers":{"host":"site.name.com:5601","connection":"keep-alive","content-length":"39","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://site.name.com:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/home","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/home"},"res":{"statusCode":200,"responseTime":39,"contentLength":9},"message":"POST /api/saved_objects/_bulk_get 200 39ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:34Z","tags":[],"pid":6718,"method":"get","statusCode":200,"req":{"url":"/ui/fonts/inter_ui/Inter-UI-Medium.woff2","method":"get","headers":{"host":"site.name.com:5601","connection":"keep-alive","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","origin":"https://site.name.com:5601","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"font","referer":"https://site.name.com:5601/app/home","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/home"},"res":{"statusCode":200,"responseTime":65,"contentLength":9},"message":"GET /ui/fonts/inter_ui/Inter-UI-Medium.woff2 200 65ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:34Z","tags":[],"pid":6718,"method":"get","statusCode":200,"req":{"url":"/api/saved_objects/_find?fields=title&per_page=1&search=%2A&search_fields=title&type=index-pattern","method":"get","headers":{"host":"site.name.com:5601","connection":"keep-alive","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/home","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/home"},"res":{"statusCode":200,"responseTime":42,"contentLength":9},"message":"GET /api/saved_objects/_find?fields=title&per_page=1&search=%2A&search_fields=title&type=index-pattern 200 42ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:34Z","tags":[],"pid":6718,"method":"get","statusCode":200,"req":{"url":"/ui/fonts/inter_ui/Inter-UI-SemiBold.woff2","method":"get","headers":{"host":"site.name.com:5601","connection":"keep-alive","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","origin":"https://site.name.com:5601","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"font","referer":"https://site.name.com:5601/app/home","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/home"},"res":{"statusCode":200,"responseTime":5,"contentLength":9},"message":"GET /ui/fonts/inter_ui/Inter-UI-SemiBold.woff2 200 5ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:34Z","tags":[],"pid":6718,"method":"post","statusCode":200,"req":{"url":"/internal/global_search/find","method":"post","headers":{"host":"site.name.com:5601","connection":"keep-alive","content-length":"75","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://site.name.com:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/home","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/home"},"res":{"statusCode":200,"responseTime":61,"contentLength":9},"message":"POST /internal/global_search/find 200 61ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:36Z","tags":[],"pid":6718,"method":"get","statusCode":200,"req":{"url":"/ui/fonts/inter_ui/Inter-UI-Bold.woff2","method":"get","headers":{"host":"site.name.com:5601","connection":"keep-alive","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","origin":"https://site.name.com:5601","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"font","referer":"https://site.name.com:5601/app/home","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/home"},"res":{"statusCode":200,"responseTime":9,"contentLength":9},"message":"GET /ui/fonts/inter_ui/Inter-UI-Bold.woff2 200 9ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:39Z","tags":[],"pid":6718,"method":"post","statusCode":200,"req":{"url":"/api/saved_objects/_bulk_get","method":"post","headers":{"host":"site.name.com:5601","connection":"keep-alive","content-length":"39","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://site.name.com:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/discover","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/discover"},"res":{"statusCode":200,"responseTime":45,"contentLength":9},"message":"POST /api/saved_objects/_bulk_get 200 45ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:39Z","tags":[],"pid":6718,"method":"get","statusCode":200,"req":{"url":"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern","method":"get","headers":{"host":"site.name.com:5601","connection":"keep-alive","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/discover","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/discover"},"res":{"statusCode":200,"responseTime":79,"contentLength":9},"message":"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 79ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:40Z","tags":[],"pid":6718,"method":"post","statusCode":200,"req":{"url":"/api/saved_objects/_bulk_get","method":"post","headers":{"host":"site.name.com:5601","connection":"keep-alive","content-length":"46","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://site.name.com:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/discover","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/discover"},"res":{"statusCode":200,"responseTime":57,"contentLength":9},"message":"POST /api/saved_objects/_bulk_get 200 57ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:40Z","tags":[],"pid":6718,"method":"post","statusCode":200,"req":{"url":"/internal/search/ese","method":"post","headers":{"host":"site.name.com:5601","connection":"keep-alive","content-length":"1955","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://site.name.com:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/discover","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/discover"},"res":{"statusCode":200,"responseTime":228,"contentLength":9},"message":"POST /internal/search/ese 200 228ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:41Z","tags":[],"pid":6718,"method":"post","statusCode":200,"req":{"url":"/internal/search/ese/FnluMU8wcHd0UjJLWE5vUXZRN3F0SUEedGJaYTZuSlNTZ2VpajVfbDZvZU5udzo5MzU5NTMx","method":"post","headers":{"host":"site.name.com:5601","connection":"keep-alive","content-length":"1955","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://site.name.com:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/discover","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/discover"},"res":{"statusCode":200,"responseTime":405,"contentLength":9},"message":"POST /internal/search/ese/FnluMU8wcHd0UjJLWE5vUXZRN3F0SUEedGJaYTZuSlNTZ2VpajVfbDZvZU5udzo5MzU5NTMx 200 405ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:44Z","tags":[],"pid":6718,"method":"get","statusCode":200,"req":{"url":"/35949/bundles/plugin/kibanaLegacy/af7ae505a9eed503f8b8e6982036873e.woff2","method":"get","headers":{"host":"site.name.com:5601","connection":"keep-alive","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","origin":"https://site.name.com:5601","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"font","referer":"https://site.name.com:5601/app/home","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/home"},"res":{"statusCode":200,"responseTime":21,"contentLength":9},"message":"GET /35949/bundles/plugin/kibanaLegacy/af7ae505a9eed503f8b8e6982036873e.woff2 200 21ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:44Z","tags":[],"pid":6718,"method":"get","statusCode":200,"req":{"url":"/ui/fonts/roboto_mono/RobotoMono-Regular.ttf","method":"get","headers":{"host":"site.name.com:5601","connection":"keep-alive","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","origin":"https://site.name.com:5601","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"font","referer":"https://site.name.com:5601/app/home","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/home"},"res":{"statusCode":200,"responseTime":33,"contentLength":9},"message":"GET /ui/fonts/roboto_mono/RobotoMono-Regular.ttf 200 33ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:48Z","tags":[],"pid":6718,"method":"post","statusCode":200,"req":{"url":"/api/saved_objects/_bulk_get","method":"post","headers":{"host":"site.name.com:5601","connection":"keep-alive","content-length":"70","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://site.name.com:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/discover","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/discover"},"res":{"statusCode":200,"responseTime":131,"contentLength":9},"message":"POST /api/saved_objects/_bulk_get 200 131ms - 9.0B"}
{"type":"log","@timestamp":"2021-12-31T21:41:49Z","tags":["error","elasticsearch","data"],"pid":6718,"message":"[status_exception]: error while executing search"}
{"type":"response","@timestamp":"2021-12-31T21:41:49Z","tags":[],"pid":6718,"method":"post","statusCode":400,"req":{"url":"/internal/search/ese","method":"post","headers":{"host":"site.name.com:5601","connection":"keep-alive","content-length":"13811","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://site.name.com:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/discover","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/discover"},"res":{"statusCode":400,"responseTime":140,"contentLength":9},"message":"POST /internal/search/ese 400 140ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:55Z","tags":[],"pid":6718,"method":"post","statusCode":200,"req":{"url":"/internal/search/ese","method":"post","headers":{"host":"site.name.com:5601","connection":"keep-alive","content-length":"1957","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://site.name.com:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/discover","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/discover"},"res":{"statusCode":200,"responseTime":223,"contentLength":9},"message":"POST /internal/search/ese 200 223ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:59Z","tags":[],"pid":6718,"method":"get","statusCode":302,"req":{"url":"/app/kibana","method":"get","headers":{"host":"site.name.com:5601","user-agent":"Go-http-client/1.1","accept-encoding":"gzip","connection":"close"},"remoteAddress":"10.10.1.41","userAgent":"Go-http-client/1.1"},"res":{"statusCode":302,"responseTime":7,"contentLength":9},"message":"GET /app/kibana 302 7ms - 9.0B"}
{"type":"response","@timestamp":"2021-12-31T21:41:59Z","tags":[],"pid":6718,"method":"get","statusCode":200,"req":{"url":"/login?next=%2Fapp%2Fkibana","method":"get","headers":{"host":"site.name.com:5601","user-agent":"Go-http-client/1.1","referer":"https://site.name.com:5601/app/kibana","accept-encoding":"gzip","connection":"close"},"remoteAddress":"10.10.1.41","userAgent":"Go-http-client/1.1","referer":"https://site.name.com:5601/app/kibana"},"res":{"statusCode":200,"responseTime":75,"contentLength":9},"message":"GET /login?next=%2Fapp%2Fkibana 200 75ms - 9.0B"}
{"type":"log","@timestamp":"2021-12-31T21:41:59Z","tags":["error","elasticsearch","data"],"pid":6718,"message":"[status_exception]: error while executing search"}
{"type":"response","@timestamp":"2021-12-31T21:41:59Z","tags":[],"pid":6718,"method":"post","statusCode":400,"req":{"url":"/internal/search/ese","method":"post","headers":{"host":"site.name.com:5601","connection":"keep-alive","content-length":"13811","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","kbn-version":"7.10.0","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://site.name.com:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://site.name.com:5601/app/discover","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.10.52.178","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36","referer":"https://site.name.com:5601/app/discover"},"res":{"statusCode":400,"responseTime":170,"contentLength":9},"message":"POST /internal/search/ese 400 170ms - 9.0B"}

matw · January 12, 2022, 10:35am

Hi, this looks like an error of the request to Elasticsearch. You should have a look at the elasticsearch logs, which version of Kibana are you using? You could also have look at the request to Elasticsearch, you can find in when you use the Inspect Button in the toolbar. What's more, a good way to debug this is to use the Request in Kibana's dev tools, where you can easily modify parameters.
Hope this helps
Best,
Matthias

system · February 9, 2022, 10:36am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.