Getting Error while trying to create and Index Pattern : "Error Fetching Fields" "Request Entity Too Large"

Greetings,

We have an elastic cluster containing 12 nodes and 1.4Tb of documents, daily indexed through a total of 7.5k shards.

Everything was working fine, but a human error caused the deletion of the .kibana* indexes.

So we now have to reconfigure our saved queries, dashboards, and foremost : reconfiguring Kibana as if it was brand new.

While trying to create some index patterns, we get the "Error Fetching Fields" -> "Request Entity Too Large" message.

I have already tried to decrease the discover:sampleSize in Advanced Settings and raising the SERVER_MAXPAYLOADBYTES to 20Mb, but we are still getting the very same error.

What should we do?

Here is the full detailled error we get:

_construct@http://elk-stack:5601/kibana/bundles/commons.bundle.js:3:1182507
Wrapper@http://elk-stack:5601/kibana/bundles/commons.bundle.js:3:1181608
HttpFetchError@http://elk-stack:5601/kibana/bundles/commons.bundle.js:3:1183196
_callee6$@http://elk-stack:5601/kibana/bundles/commons.bundle.js:3:2179958
tryCatch@http://elk-stack:5601/kibana/built_assets/dlls/vendors.bundle.dll.js:471:789345
invoke@http://elk-stack:5601/kibana/built_assets/dlls/vendors.bundle.dll.js:471:793188
defineIteratorMethods/</prototype[method]@http://elk-stack:5601/kibana/built_assets/dlls/vendors.bundle.dll.js:471:790468
asyncGeneratorStep@http://elk-stack:5601/kibana/bundles/commons.bundle.js:3:2171576
_next@http://elk-stack:5601/kibana/bundles/commons.bundle.js:3:2171904
1 Like

This issue should be resolvable by the server.maxPayloadBytes setting, like in this question: Payload too large

Can you elaborate on how exactly you set this setting in your case (how are you starting Kibana, how are you passing the setting in, what exact value did you set it to)?

I am using the Kibana Docker Image docker.elastic.co/kibana/kibana:7.4.0 and setting environnement variables in my docker-compose.yml as such:

kibana:
    image: docker.elastic.co/kibana/kibana:7.4.0
    container_name: kibana
    hostname: kibana
    restart: always
    volumes:
      - /etc/localtime:/etc/localtime:ro
    environment:
      LOGGING_TIMEZONE: Europe/Paris
      ELASTICSEARCH_REQUESTTIMEOUT: 90000
      NODE_OPTIONS: "--max-old-space-size=4096"
      KIBANA_AUTOCOMPLETETIMEOUT: 3000
      SERVER_BASEPATH: "/kibana"
      SERVER_REWRITEBASEPATH: "true"
      SERVER_MAXPAYLOADBYTES: 20971520

    ports:
      - "5601:5601"
    depends_on:
      - elasticsearch

Then, I am applying the new setting with docker-compose up -d kibana

I'm not sure how large your index patterns are - if there are thousands of fields, even 20mb can be too little. Can you try 200 mb?

Already did, and we still get the error.

On which hardware does this payload work? cache? memory? disk space? Just so I would know how far I may go increasing the value

Pushed it to 512 Mb, and still getting the error

Are you running something in front of Kibana (load balancer, reverse proxy?) Maybe it's not Kibana causing the issue

1 Like

We do have a NGinx proxy, yes ; Getting around it almost did the trick, error has changed:

request/<@http://192.168.100.32:5601/kibana/bundles/commons.bundle.js:3:1337052

It seems like your browser blocked the request - maybe some plugin or related to the TLS problem? I recommend setting the max upload size of your nginx proxy to the same value as the Kibana setting to resolve that.

I reconfigured NGinx as you asked and there is the error again,

request/<@https://elk-stack/kibana/bundles/commons.bundle.js:3:1337196
promise callback*request@https://elk-stack/kibana/bundles/commons.bundle.js:3:1337028
getFieldsForWildcard@https://elk-stack/kibana/bundles/commons.bundle.js:3:1338498
fetchForWildcard@https://elk-stack/kibana/bundles/commons.bundle.js:3:2630009
fetch@https://elk-stack/kibana/bundles/commons.bundle.js:3:2629714
_callee9$@https://elk-stack/kibana/bundles/commons.bundle.js:3:1328055
tryCatch@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:789345
invoke@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:793188
defineIteratorMethods/</prototype[method]@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:790468
asyncGeneratorStep@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309619
_next@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309947
_asyncToGenerator/</<@https://elk-stack/kibana/bundles/commons.bundle.js:3:1310084
_asyncToGenerator/<@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309842
_fetchFields@https://elk-stack/kibana/bundles/commons.bundle.js:3:1328310
refreshFields@https://elk-stack/kibana/bundles/commons.bundle.js:3:1328436
_callee$@https://elk-stack/kibana/bundles/commons.bundle.js:3:1314623
tryCatch@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:789345
invoke@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:793188
defineIteratorMethods/</prototype[method]@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:790468
asyncGeneratorStep@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309619
_next@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309947
_asyncToGenerator/</<@https://elk-stack/kibana/bundles/commons.bundle.js:3:1310084
_asyncToGenerator/<@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309842
indexFields@https://elk-stack/kibana/bundles/commons.bundle.js:3:1314767
_callee2$@https://elk-stack/kibana/bundles/commons.bundle.js:3:1316804
tryCatch@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:789345
invoke@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:793188
defineIteratorMethods/</prototype[method]@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:790468
asyncGeneratorStep@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309619
_next@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309947
_asyncToGenerator/</<@https://elk-stack/kibana/bundles/commons.bundle.js:3:1310084
_asyncToGenerator/<@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309842
updateFromElasticSearch@https://elk-stack/kibana/bundles/commons.bundle.js:3:1316968
_callee3$@https://elk-stack/kibana/bundles/commons.bundle.js:3:1318418
tryCatch@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:789345
invoke@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:793188
defineIteratorMethods/</prototype[method]@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:790468
asyncGeneratorStep@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309619
_next@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309947
promise callback*asyncGeneratorStep@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309737
_next@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309947
_asyncToGenerator/</<@https://elk-stack/kibana/bundles/commons.bundle.js:3:1310084
_asyncToGenerator/<@https://elk-stack/kibana/bundles/commons.bundle.js:3:1309842
init@https://elk-stack/kibana/bundles/commons.bundle.js:3:1318643
IndexPatterns/<@https://elk-stack/kibana/bundles/commons.bundle.js:3:2635713
IndexPatterns/<@https://elk-stack/kibana/bundles/commons.bundle.js:3:2635520
indexPattern@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4229723
invoke@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:417:53632
wrapRouteWithPrep/</resolve[name]/<@https://elk-stack/kibana/bundles/commons.bundle.js:3:2270463
processQueue@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:417:203810
scheduleProcessQueue/<@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:417:204785
$digest@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:417:214759
$evalAsync/<@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:417:217468
completeTask@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:417:229358
Browser/self.defer/timeoutId<@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:417:67644
setTimeout handler*Browser/self.defer@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:417:67576
$evalAsync@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:417:217421
changeUrl@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4138960
_callee3$@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4149188
tryCatch@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:789345
invoke@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:793188
defineIteratorMethods/</prototype[method]@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:790468
asyncGeneratorStep@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4143008
_next@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4143336
promise callback*asyncGeneratorStep@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4143126
_next@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4143336
promise callback*asyncGeneratorStep@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4143126
_next@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4143336
_asyncToGenerator/</<@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4143473
_asyncToGenerator/<@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4143231
CreateIndexPatternWizard/</<@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4149365
_callee2$@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4204095
tryCatch@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:789345
invoke@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:793188
defineIteratorMethods/</prototype[method]@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:471:790468
asyncGeneratorStep@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4199231
_next@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4199559
_asyncToGenerator/</<@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4199696
_asyncToGenerator/<@https://elk-stack/kibana/bundles/kibana.bundle.js:3:4199454
ca@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:846
ja@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:1000
ka@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:1054
wa@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:1806
Aa@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:2280
ya@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:2089
Da@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:3224
Ad@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:30904
Gi@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:99871
Kb@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:10622
Dd@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:31386
Ii/<@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:100141
vendors</</exports.unstable_runWithPriority@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:151:3314
Ii@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:100066
Cd@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:31127
EventListener.handleEvent*E@https://elk-stack/kibana/built_assets/dlls/vendors.bundle.dll.js:200:30988

So, I have retried using direct access to Kibana, and still no luck (got a couple of 401)

Can you share your nginx config? My guess is something's not forwarded correctly in there. Also, is the rest of Kibana working fine? Can you create other index patterns? Can you view/edit existing visualiuzations?

I may very much do so, I'll paste it at the end of this post.

We managed to create index patterns on smaller samples (for instance filebeat-*-ONE_APP-* and filebeat-*-ANOTHER_APP-*) but we do need the global filebeat-* index pattern for most of our Dashboards

    user  nginx;
    worker_processes  auto;

    error_log  /var/log/nginx/error.log warn;
    pid        /var/run/nginx.pid;


    events {
        worker_connections  1024;
    }


    http {
        include       /etc/nginx/mime.types;
        default_type  application/octet-stream;

        client_body_timeout 9600;
        client_header_timeout 9600;
        send_timeout 9600;
        client_max_body_size 10240M;

        auth_ldap_cache_enabled on;
        auth_ldap_cache_expiration_time 10000;
        auth_ldap_cache_size 1000;

        ldap_server MY_COMPANY {
            url ldap://172.16.14.3:3268/DC=MY_COMPANY,DC=local?sAMAccountName?sub?(objectClass=user);
            binddn "CN=indus,OU=technical_user,OU=Bgx,OU=Users,OU=HA,DC=MY_COMPANY,DC=local";
            binddn_passwd MY_PASSWORD;
            group_attribute uniquemember;
            group_attribute_is_dn on;
            require valid_user;
        }

        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent "$http_referer" '
                          '"$http_user_agent" "$http_x_forwarded_for"';

        access_log  /var/log/nginx/access.log  main;

        sendfile        on;
        #tcp_nopush     on;

        keepalive_timeout  65;

        #gzip  on;

        include /etc/nginx/conf.d/*.conf;
    }

      ssl_session_cache   shared:SSL:10m;
      ssl_session_timeout 10m;

      server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;

        # Discourage deep links by using a permanent redirect to home page of HTTPS site
        return 301 https://$host;

        # Alternatively, redirect all HTTP links to the matching HTTPS page
        # return 301 https://$host$request_uri;
      }

      server {

        listen              443 ssl;
        server_name         MY_COMPANY;
        keepalive_timeout   70;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        ssl_certificate     conf.d/MY_COMPANY.crt;
        ssl_certificate_key conf.d/MY_COMPANY.key;
        ssl_protocols       TLSv1.2;
        ssl_ciphers         HIGH:!aNULL:!MD5;

        error_log   /var/log/nginx/nginx-errors.log;
        access_log  /var/log/nginx/access_logs.log;

        # LDAP Authorize access
        auth_ldap "Login with LDAP account";
        auth_ldap_servers MY_COMPANY;

        error_page 404 /404.html;
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /usr/share/nginx/html;
        }

        location /kibana/ {
          # Pass requests to ElasticSearch
          proxy_pass http://kibana:5601;
        }
            # Catch for a stray kibana call that doesn't properly prepend the proxy URI
            location /api {
                    if ($http_referer ~ "^.*/kibana") {
                            proxy_pass http://127.0.0.1:5601;
                    }
            }
      }

Hm, the only thing looking strange to me is the /api rule by the end of the file - shouldn't it redirect to http://kibana:5601 as well?

It looks like you don't have security enabled in Kibana/Elasticsearch itself, so the 401s seem pretty strange. Can you check what gets returned for the 401 requests?

Also, can you see anything in the logs on the proxy or on Kibana itself?

Nope, it's a self redirect and is working perfectly as intended on this part

We have 7,4k shards for 1.3Tb of indexed data by elasticsearch.

We need to define our Index Pattern filebeat-* in order to set it as default and use it for our visualisations and dashboard.

for what I'll do for now on, I will work around the nginx proxy and use kibana UI directly. I am using latest Firefox stable release.

NOTE: in the begining, when we had less data, filebeat-* Index Pattern was created successfully within seconds.

I have set discover.sampleSize to 50.

The first alarming issue comes in the first step of creating Index Pattern:

We should get @timestamp as a common time fields across all our data, yet Kibana isn't proposing it.

I hit Create Index Pattern anyway

Issue is less about the 401 response (which I got hitting Kibana directly without going through nginx) than the fact that the inex pattern creation stalls:

Here are the Kibana logs:

kibana             | {"type":"response","@timestamp":"2020-09-24T14:29:35Z","tags":[],"pid":6,"method":"get","statusCode":200,"req":{"url":"/api/index_patterns/_fields_for_wildcard?pattern=filebeat-*&meta_fields=_source&meta_fields=_id&meta_fields=_type&meta_fields=_index&meta_fields=_score","method":"get","headers":{"host":"192.168.100.32:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0","accept":"*/*","accept-language":"fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3","accept-encoding":"gzip, deflate","referer":"http://192.168.100.32:5601/kibana/app/kibana","kbn-version":"7.4.0","content-type":"application/json","connection":"keep-alive","pragma":"no-cache","cache-control":"no-cache"},"remoteAddress":"172.16.14.171","userAgent":"172.16.14.171","referer":"http://192.168.100.32:5601/kibana/app/kibana"},"res":{"statusCode":200,"responseTime":582193,"contentLength":9},"message":"GET /api/index_patterns/_fields_for_wildcard?pattern=filebeat-*&meta_fields=_source&meta_fields=_id&meta_fields=_type&meta_fields=_index&meta_fields=_score 200 582193ms - 9.0B"}
kibana             | {"type":"log","@timestamp":"2020-09-24T14:48:45Z","tags":["status","plugin:xpack_main@7.4.0","error"],"pid":6,"state":"red","message":"Status changed from green to red - Request Timeout after 90000ms","prevState":"green","prevMsg":"Ready"}
kibana             | {"type":"log","@timestamp":"2020-09-24T14:48:45Z","tags":["status","plugin:graph@7.4.0","error"],"pid":6,"state":"red","message":"Status changed from green to red - Request Timeout after 90000ms","prevState":"green","prevMsg":"Ready"}
kibana             | {"type":"log","@timestamp":"2020-09-24T14:48:45Z","tags":["status","plugin:spaces@7.4.0","error"],"pid":6,"state":"red","message":"Status changed from green to red - Request Timeout after 90000ms","prevState":"green","prevMsg":"Ready"}
kibana             | {"type":"log","@timestamp":"2020-09-24T14:48:45Z","tags":["status","plugin:searchprofiler@7.4.0","error"],"pid":6,"state":"red","message":"Status changed from green to red - Request Timeout after 90000ms","prevState":"green","prevMsg":"Ready"}
(..)
kibana             | {"type":"response","@timestamp":"2020-09-24T15:07:48Z","tags":[],"pid":6,"method":"get","statusCode":200,"req":{"url":"/api/index_patterns/_fields_for_wildcard?pattern=filebeat-*&meta_fields=_source&meta_fields=_id&meta_fields=_type&meta_fields=_index&meta_fields=_score","method":"get","headers":{"host":"192.168.100.32:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0","accept":"*/*","accept-language":"fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3","accept-encoding":"gzip, deflate","referer":"http://192.168.100.32:5601/kibana/app/kibana","kbn-version":"7.4.0","content-type":"application/json","connection":"keep-alive","pragma":"no-cache","cache-control":"no-cache"},"remoteAddress":"172.16.14.171","userAgent":"172.16.14.171","referer":"http://192.168.100.32:5601/kibana/app/kibana"},"res":{"statusCode":200,"responseTime":568928,"contentLength":9},"message":"GET /api/index_patterns/_fields_for_wildcard?pattern=filebeat-*&meta_fields=_source&meta_fields=_id&meta_fields=_type&meta_fields=_index&meta_fields=_score 200 568928ms - 9.0B"}
kibana             | {"type":"response","@timestamp":"2020-09-24T15:17:16Z","tags":[],"pid":6,"method":"get","statusCode":200,"req":{"url":"/api/index_patterns/_fields_for_wildcard?pattern=filebeat-*&meta_fields=_source&meta_fields=_id&meta_fields=_type&meta_fields=_index&meta_fields=_score","method":"get","headers":{"host":"192.168.100.32:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0","accept":"*/*","accept-language":"fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3","accept-encoding":"gzip, deflate","referer":"http://192.168.100.32:5601/kibana/app/kibana","kbn-version":"7.4.0","content-type":"application/json","connection":"keep-alive","pragma":"no-cache","cache-control":"no-cache"},"remoteAddress":"172.16.14.171","userAgent":"172.16.14.171","referer":"http://192.168.100.32:5601/kibana/app/kibana"},"res":{"statusCode":200,"responseTime":575445,"contentLength":9},"message":"GET /api/index_patterns/_fields_for_wildcard?pattern=filebeat-*&meta_fields=_source&meta_fields=_id&meta_fields=_type&meta_fields=_index&meta_fields=_score 200 575445ms - 9.0B"}

OK,

So with being unable to sort this out, we went a different way. We used a flat-file-backup from 14 days ago, and restarted the cluster. Everything went almost smooth, beside some issues related to a known bug of elasticsearch 7.x.

The whole stack is back online now, but we lost 14 days of data, which is kind of a bummer.

Nevertheless, thank you for the time you spent trying to help us out, and sorry we couldn't find a satisfying answer to this problem.

Regards,

Hey, glad to hear you found some way out.

Sorry for the late answer - it seems like due to the amount of data Kibana is running into several issues when creating the index pattern (not just the request body limit).

For the next time (or someone stumbling over this thread), you can also try to create the index pattern for a small subset of the data you know has the same mapping as the other indices (e.g. filebeat-2020-10-01). Then, you can edit the saved object and change filebeat-2020-10-01 to filebeat-*. As index patterns are referenced by id, this will propagate to all visualizations / saved searches attached to it

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.