Kibana 6.3 - 502 Response for saving any search

[Harshad_Velapure]

While saving/editing any visualisation or dashboard, getting below error

Dashboard: 502 Response

Less Info
OK
Error: 502 Response
at https:///bundles/commons.bundle.js:3:428829
at processQueue (https:///bundles/vendors.bundle.js:133:134252)
at https:///bundles/vendors.bundle.js:133:135201
at Scope.$digest (https:///bundles/vendors.bundle.js:133:146077)
at Scope.$apply (https:///bundles/vendors.bundle.js:133:148856)
at done (https:///bundles/vendors.bundle.js:133:101124)
at completeRequest (https:///bundles/vendors.bundle.js:133:106024)
at XMLHttpRequest.xhr.onload (https:///bundles/vendors.bundle.js:133:106783)

[bhavyarm]

Hi,

Is this on es/kibana 6.3.0? Are you using the default distribution( with basic license) or the oss? Also which os? Where do you see the error? Can you please post a screenshot of it? Can you still save the dashboard/viz or saving is not possible?

Thanks,
Bhavya

[Harshad_Velapure]

Hello @bhavyarm
Thank you for reply.

Yes this is on kibana 6.3.0 and default distribution (x-pack free version)
Operating System: CentOs 7.3.1611

I am still able to save my searches and any changes made to viz or dashboards. Uploaded one screenshot here. elk_dashboard_issue_snapshot|690x387

Also I have noticed that it takes around 5-7 seconds in order to save any new modification.

Please let me know if I am missing something.

[bhavyarm]

Hi,

I cannot access that screenshot. Also are you seeing this error in Console? Can you try to upload the screenshot again?

If its taking 5-7 seconds for any modification - it could be because of your datasize and machine size. We had one bug prior to 6.3.0 on data table - but we fixed it.
So - you might want to check your machine/data size.

Thanks,
Bhavya

[Harshad_Velapure]

@bhavyarm
Sorry about that screenshot

I am seeing this error on UI only in Console status is 200

There is no change in data size as such, earlier I was using version 5.6 and on that things were working fine. Recently we migrated from 5.6 to 6.3

Could this be related to .kibana index ?

[bhavyarm]

It could be that one of the viz is causing this. I have asked our dashboard team to take a look at it.

Lets see what they say.

Cheers,
Bhavya

[Nathan_Reese]

Are there any errors in the browser console?

[Harshad_Velapure]

@bhavyarm
Thanks a lot !

@Nathan_Reese
Below is the error screen when I opened one of the dashboard

Upon saving that dashboard I get below error for post request

Thanks,
Harshad

[Nathan_Reese]

What browser are you using?

[Harshad_Velapure]

I am using Chrome browser

[Harshad_Velapure]

Hello, we did rolling upgrade of ELK about 3 weeks ago from 5.6 to 6.3
Could this error be related to any missing step on .kibana index ?
Please let me know your thoughts, any clue would be a great help !

[Nathan_Reese]

What version of chrome?

[Harshad_Velapure]

I am using Version 67.0.3396.99 (Official Build) (64-bit)

[Nathan_Reese]

Thanks for the information about your browser.

It sounds like you may have corrupt data in local storage. In a tab that is open to Kibana, can you open the Chrome developer tools, then go to the Application tab. In the Storage section expand Local Storage. After that, you'll see all your browser's local storage for kibana. What is in the typeahead:discover-lucene or typeahead:discover-kuery variable? You should see an array of strings. Do you have a null or undefined value in the array?

[Harshad_Velapure]

thanks, sure let me check...

[Harshad_Velapure]

It's something as below,

[""some-value"", "requestbody:"some-value"", "accessURL:"some-value"",…]
0: ""some-value""
1: "requestbody:"some-value""
2: "accessURL:"some-value""
3: ""GET some-value""
4: "27835504661 AND 723868298 AND 000000402881807101048475084002"
5: "27835504661 AND 723868298"
6: "27835504661"
7: "country"

I don't see any null values in this.

[Harshad_Velapure]

Updating error part. On browser, I get error for vendor.js line 133. Below is the snippet

[Nathan_Reese]

Can you try starting kibana with different .kibana index, maybe call it .testkibana. Can the same error be triggered?

[Harshad_Velapure]

It's a prod environment, I will check if it's doable.

Thanks a lot !