Kibana 500 - huge index patterns

Elastic Stack Kibana
1

Hi,

I have the following problem in Kibana 6.1.2

Screenshot%20from%202018-04-13%2015-44-28
Screenshot from 2018-04-13 15-44-28.png1915×985 238 KB

The problem occurs when creating or trying to open index pattern.

It only occurs in one particular pattern. This pattern contains over 500 fields and is nested a lot (over 2k fields in total). The pattern cannot be viewed / edited / deleted.

My theories are:

  • The pattern mapping is just too big
  • The pattern matched more than one index type (definitely not true for all the patterns)
    EDIT: it did not

I will probably try deleting the .kibana index.
EDIT: deleting the index did not help

Any ideas how to fix?

1 Like
2

Hmm, not sure.

What do the Kibana server-logs say? Is something erroring out or crashing there?

3

Hi i do not have full access to the server but I have this older Kibana log

{"type":"error","@timestamp":"2018-04-10T17:27:39Z","tags":[],"pid":1,"level":"error","error":{"message":"Internal Server Error","name":"Error","stack":"Internal Server Error :: {\"path\":\"/.kibana/doc/index-pattern%3A69ec8320-328f-11e8-93e3-2df0687de10e/_update\",\"query\":{\"refresh\":\"wait_for\"},\"body\":\"{\\\"doc\\\":{\\\"updated_at\\\":\\\"2018-04-10T17:27:39.263Z\\\",\\\"index-pattern\\\":{\\\"title\\\":\\\"email-probe-day-scanner*\\\",\\\"timeFieldName\\\":\\\"timestamp\\\",\\\"fields\\\":\\\"[{\\\\\\\"name\\\\\\\":\\\\\\\"_id\\\\\\\",\\\\\\\"type\\\\\\\":\\\\\\\"string\\\\\\\",\\\\\\\"count\\\\\\\":0,\\\\\\\"scripted\\\\\\\":false,\\\\\\\"searchable\\\\\\\":true,\\\\\\\"aggregatable\\\\\\\":true,\\\\\\\"readFromDocValues\\\\\\\":false},{\\\\\\\"name\\\\\\\":\\\\\\\"_index\\\\\\\",\\\\\\\"type\\\\\\\":\\\\\\\"string\\\\\\\",\\\\\\\"count\\\\\\\":0,\\\\\\\"scripted\\\\\\\":false,\\\\\\\
.... this goes forerver ;)
ends with this:
\\\"count\\\\\\\":0,\\\\\\\"scripted\\\\\\\":false,\\\\\\\"searchable\\\\\\\":true,\\\\\\\"aggregatable\\\\\\\":true,\\\\\\\"readFromDocValues\\\\\\\":true},{\\\\\\\"name\\\\\\\":\\\\\\\"young_user_many_rcpts\\\\\\\",\\\\\\\"type\\\\\\\":\\\\\\\"number\\\\\\\",\\\\\\\"count\\\\\\\":0,\\\\\\\"scripted\\\\\\\":false,\\\\\\\"searchable\\\\\\\":true,\\\\\\\"aggregatable\\\\\\\":true,\\\\\\\"readFromDocValues\\\\\\\":true}]\\\"}}}\",\"statusCode\":500,\"response\":\"<html>\\r\\n<head><title>500 Internal Server Error</title></head>\\r\\n<body bgcolor=\\\"white\\\">\\r\\n<center><h1>500 Internal Server Error</h1></center>\\r\\n<hr><center>nginx</center>\\r\\n</body>\\r\\n</html>\\r\\n\"}\n    at respond (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:295:15)\n    at checkRespForFailure (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:254:7)\n    at HttpConnector.<anonymous> (/usr/share/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:159:7)\n    at IncomingMessage.bound (/usr/share/kibana/node_modules/elasticsearch/node_modules/lodash/dist/lodash.js:729:21)\n    at emitNone (events.js:91:20)\n    at IncomingMessage.emit (events.js:185:7)\n    at endReadableNT (_stream_readable.js:974:12)\n    at _combinedTickCallback (internal/process/next_tick.js:80:11)\n    at process._tickDomainCallback (internal/process/next_tick.js:128:9)"},"url":{"protocol":null,"slashes":null,"auth":null,"host":null,"port":null,"hostname":null,"hash":null,"search":"","query":{},"pathname":"/api/saved_objects/index-pattern/69ec8320-328f-11e8-93e3-2df0687de10e","path":"/api/saved_objects/index-pattern/69ec8320-328f-11e8-93e3-2df0687de10e","href":"/api/saved_objects/index-pattern/69ec8320-328f-11e8-93e3-2df0687de10e"},"message":"Internal Server Error"}
4

Hi here is log from docker/kibana-oss:6.1.2 https://pastebin.com/WHLqKhri

5

Hi Thomas,

any suggestions?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.