# Ideas for helping prevent users requesting every log ever **URL:** \ **Category:** Kibana\ **Created:** [March 27, 2019, 7:33pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190 "2019-03-27T19:33:49Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![djtecha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djtecha/32/54011_2.png) [@djtecha](https://discuss.elastic.co/u/djtecha)\ **Post date:** [March 27, 2019, 7:33pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190/1 "2019-03-27T19:33:49Z")
Hello, I'm trying to come up with a good solution to what I would think is a common problem. Currently managing a cluster over 1PB of data, when a user logs in they get the default discovery page which runs the query to search ALL logs over the last 1 minute. Now, there is training around teaching users to use filters and how to write a performant query. But, you are always going to have those users that want all the logs "\*" since the beginning of time. Now, in this case, Kibana timeout like it should, and the query is eventually canceled, but this logs a 500 error and just in general isn't a great user experience to get a big red banner claiming a "Gateway timeout" So, I was wondering if anyone has any good ideas on how to encourage better behavior via a technological implementation? Once users have filters there isn't much issue across searching from the start of time, and that is a valid use case. So, i'm just looking for ideas here. Thanks ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [March 27, 2019, 7:50pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190/2 "2019-03-27T19:50:14Z")
Hey @djtecha, great question! Is your primary concern with the fact that we're showing a "Gateway timeout" error as opposed to a more user friendly error? Or are you looking for a way to apply some filters by default? ---
**Author:** ![djtecha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djtecha/32/54011_2.png) [@djtecha](https://discuss.elastic.co/u/djtecha)\ **Post date:** [March 27, 2019, 7:55pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190/3 "2019-03-27T19:55:06Z")
Well, it would be nice if we could set that banner so the user might not make the same mistake twice. Ideally if this was logged as something other then a 5XX error so our monitors tracking 5XXs wouldn't pick up these cases. But, also adding default filters that the user has to change to continue upon logging in would be useful as well. Or any other ideas around this. Just kind of brainstorming here 🙂 ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [March 27, 2019, 8:27pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190/4 "2019-03-27T20:27:04Z")
> Ideally if this was logged as something other then a 5XX error so our monitors tracking 5XXs wouldn't pick up these cases. Agreed. Which version of Kibana are you running? On 6.7.0, I'm seeing the following error displayed when the `elasticsearch.requestTimeout` is hit, and the HTTP response is being shown as a `200`. ![55%20PM](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea20546c9a8b068152a34876d5fefdce00c2da66.png) Do you have a reverse-proxy in front of Kibana which is enforcing it's own timeouts? If so, we'll likely want to set `elasticsearch.requestTimeout` to a value smaller than the reverse-proxy timeout, so this default behavior will be hit. > Or any other ideas around this. Just kind of brainstorming here 🙂 One other possibility would be using a [filtered index alias](https://www.elastic.co/guide/en/elasticsearch/reference/6.7/indices-aliases.html#filtered) and setting this as the default index pattern in Kibana. It'd by default display a subset of data, and allow the user to select an index pattern which returns all of the data. ---
**Author:** ![djtecha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djtecha/32/54011_2.png) [@djtecha](https://discuss.elastic.co/u/djtecha)\ **Post date:** [March 27, 2019, 8:41pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190/5 "2019-03-27T20:41:50Z")
There is no reverse proxy going, but it is going through a load balancer. But that timeout is set to longer then the requestTimeout. The above screenshot is what the user see's. I'm running 6.5.4 and I used to be able to get the "failed shard" response which would return some results but I can't seems to get that to show up anymore. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [March 27, 2019, 8:58pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190/6 "2019-03-27T20:58:43Z")
Hey @djtecha, I'm not seeing the screenshot that you're referring to, would you mind double checking that it uploaded? ---
**Author:** ![djtecha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djtecha/32/54011_2.png) [@djtecha](https://discuss.elastic.co/u/djtecha)\ **Post date:** [March 27, 2019, 9:05pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190/7 "2019-03-27T21:05:30Z")
Ohh sry for the confusion, I meant it's identical to the one you posted. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [March 27, 2019, 9:39pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190/8 "2019-03-27T21:39:52Z")
Gotcha. When I see the `elasticsearch.requestTimeout` being hit on 6.5.4, I'm seeing the following, with the network request itself being cancelled, I'm not seeing the 500 response: ![16%20PM](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f44159a5322ac7fd28edd0c22281e0aae15b2e93.png) If in Chrome to right-click and select "Inspect" and then look at the "Network" tab, do you see Kibana returning a 500? ---
**Author:** ![djtecha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djtecha/32/54011_2.png) [@djtecha](https://discuss.elastic.co/u/djtecha)\ **Post date:** [March 27, 2019, 9:43pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190/9 "2019-03-27T21:43:57Z")
Interesting, so there's some odd configuration difference here: ![49%20PM](https://us1.discourse-cdn.com/elastic/original/3X/1/3/13e5cd8da36b007feaef457e225eb0d24bb7e6b5.png) ---
**Author:** ![djtecha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djtecha/32/54011_2.png) [@djtecha](https://discuss.elastic.co/u/djtecha)\ **Post date:** [March 27, 2019, 9:46pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190/10 "2019-03-27T21:46:33Z")
So you got a 200 correct? I have an idle connection timeout at 100s but the requestTimout at 89s so i'm a little confused as to whats terminating the connection at that point. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 24, 2019, 9:46pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190/11 "2019-04-24T21:46:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.