Kibana all of a sudden requesting a larger result_window?

gborg · January 11, 2023, 3:17pm

Hello

I have a cluster with multiple elasticsearch nodes and a kibana server

I have not made any modifications to kibana recently, nor the indexing settings but all of a sudden one day I get "X of Y shards failed" and when I look into it the reason is that the "max_result_window" is 10'000, not 50'000

Why is kibana all of a sudden requesting 5 times as large result window ?

jsanz · January 17, 2023, 12:21pm

As far as I know, Kibana does not change that setting directly and it will honor the actual value set up on the index (the default is 10k, yes)

For example, on this discussion the Maps application is needing read access to that setting.

github.com/elastic/kibana

Allow Kibana internal user to access data index settings

opened 07:18PM - 18 Dec 19 UTC

closed 02:39PM - 31 Jul 20 UTC

nreese

discuss Team:Security enhancement

The Maps application uses index settings `max_result_window` and `max_inner_resu…lt_window` in `_search` requests to know the maximum number of documents to request and maximum number of top hits to request. Currently, the only way to fetch index settings is to use `callWithRequest` which uses the user's permissions. The problem is that users may have read access to the index yet not have `view_index_metadata` to allow read access to index settings. This puts our usability in a difficult situation. In the case that the user does not have `view_index_metadata` then we have to display crufty messaging about missing permissions and fall back to default values. These default values could cause `_search` request errors. For example, if `max_result_window` is set to a smaller value then the default, `_search` requests with the default `max_result_window`will fail with another super crufty message. For these cases, we would like to use Kibana's user to access the data index settings so we always have the right values regardless of user permissions.

Anyways, that setting is associated with each index and can be changed anytime as documented here. Maybe you need to take a look at your indices in case this setting has changed on any of them?

gborg · February 7, 2023, 3:41pm

If anyone enters this thread with the same issue as me .....

In my case it seems that sometime in the past I have edited the "advanced kibana setting" of "Discover:sampleSize" and restoring that to a lower value fixed this

Same as here

system · March 7, 2023, 3:42pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.