Hello,
I've created a new index and index pattern in filebeat.yml file and send data to Elastic search running in aws container.
when I go to Kibana I can see the new index getting created under 'Index Management', but when I try to create 'Index Pattern' I get: Error Request Entity Too Large
any idea what could be causing it? this index barely has a few Ks of data
You can increase the server.maxPayloadBytes setting in your kibana.yml . Please refer to our documentation how to do this.
ok thanks for reply, will take a look, but a it's a littler weird because
other indexes work fine and they have a lot of data. this particular index is a brand new one
and has a few K of data so why would it fail during Index Pattern setup?
Thanks, Michael
what is your current server.maxPayloadBytes set to?
actually, we don't have that variable set in the Kibana config at all
Sorry, starting 7.13 this setting was renamed to maxPayload. So depending on which Kibana version you are running, you should have at least one of them. The default value is 1048576.
don't have this one either...
This is a standard setting in kibana.yml
If it's commented out or missing, the default value will be taken as 1048576, as mentioned above. I suggest you increase this number and see if that solves your issue, as I suspect it will.
well, we tried the same thing from linux box (I was running mine from Windows)
and we ran this before starting filebeat
"curl -XPUT -H "Content-Type: application/json" 'http://'$esurl':80/_template/filebeat?pretty' -d@/etc/filebeat/filebeat.template.json"
and then started filebeat, noticed that index was created and I was able to create Index Patterns with no problems.
however, my windows installation does not have that 'filebeat.template.json' file
so I don't think it's the 'maxPayload' param issue since it works in one case, but not the other
any ideas?
maxPayload param is Kibana's config parameter, not a filebeat one. It is defined in kibana.yml and you will need to update this on your server running Kibana.
rigtht, I understand that it's kibana param,
my point was that without changing that parameter in Kibana, I'm Not able to create Index Pattern in the first above described case, but I was able to do it in the second above described case by sending that filebeat.template.json to elastic search first.(using the same steps), but as I also mentioned in my windows installation of filebeat I don't see that filebeat.template.json
I am not super familiar with filebeat, but we have a guide on how to create a json template manually. Let me know if this doesn't work and we can check further with my colleagues from filebeat.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.